SQL injection, when data becomes code

New idea

Can typing text break into a site?

Some careless sites were beaten by typing ' OR '1'='1 into the login box instead of a name. No hacking tools, only a few quotes. How can plain text do that?

Sites keep users in a database and ask it questions in a language called SQL. A question (a query) looks like this: SELECT * FROM users WHERE name = 'sam'. It means: give me every user whose name is sam.

The text between the quotes 'sam' is data. Everything else is code the database runs. A careless program builds the query by gluing your input into the middle.