Yes, it is injection because you are injecting your code into the existing SQL code.
For example. A common way to log a user in using php and SQL looks like this:
$sql = "SELECT * FROM users WHERE username = '" . $POST['username'] . "' AND password = '" . $POST['password'] . "';"
The variables $POST['username'] and $POST['password'] what the user puts in the login fields. If the user entered the following.
' or 1 == 1 ---
The resulting SQL that is executed looks like this:
SELECT * FROM users WHERE username = '' or 1 == 1 --- AND password = '';
Notice that everything after the "---" is a comment and ignored. So the sql looks to see if it can find a username that matches null or 1 == 1. Since 1 always equals 1, the SQL will return true and log the user in.
This is called injection because the user is injecting their code into the code the developer wrote.
Is that because the attacker injects (inserts) malicious code/commands into the data sent to the application?
. Yes. – user81147 Nov 7 '16 at 8:41