SQL injection happens when user input gets embedded directly into a database query. An attacker enters code that changes what the query does.
Example: If username is "admin'; DROP TABLE users;--", your database gets wiped.
AI models often generate vulnerable code because older tutorials taught string concatenation. Always use parameterized queries. Never concatenate user input into SQL strings.