To give a (somewhat trivial, off top of head) example of sql injection, imagine this query somewhere in your app code ...
select 1 from user where name='[NAME]' and password='[PASS]'
after Malicious Guy sets named parameters above to his choosing, you get:
select 1 from user where name='admin' --' and password='[PASS]'
using the following chosen, unsanitized values:
[NAME]=' --' and password='[PASS]'
value of [PASS] variable is unimportant
Thus, assuming the query is meant to return 1 for success and empty set for invalid user or pass, a 1 would be erroneously returned, allowing this evil user to log in as the "admin" account.