A SQL injection occurs when entered data is inserted into a SQL query as code. An attacker can then read, modify, or delete data. The cause is concatenating uncontrolled text into the query; the countermeasure is the parameterized query.
Example
query = "SELECT * FROM users WHERE name = '" + nom + "'" # vulnerable