SQL injection is a web application vulnerability in which an attacker injects malicious SQL statements through user input. If the application fails to properly validate or sanitize the input, these statements can be executed by the database, potentially allowing unauthorized access, data modification, or data theft.