Definition of SQL Injection
SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).
How SQL Injection impacts the Android O.S
The SQLite used in android apps are fully functional databases, so just like SQL Server or MySQL box they can be susceptible to SQL injection. SQL injection typically works by adding data to the query string or adding data in a form field; to give hackers access to a database or unauthorized logins. SQL Injection is usually used to attack Web Views or a web service but it can also be used to attack Activities.
The root cause of the SQL Injection vulnerability is due to the use of dynamic or concatenated SQL queries. If SQL queries are constructed by concatenating user supplied inputs; The user can then supply SQL attack vectors instead of valid inputs and manipulate the backend SQL query.
The injection process works by prematurely terminating a text string and appending a new command. Because the inserted command may have additional strings appended to it before it is executed, the injected string is terminated with a comment mark “–”. Subsequent text is ignored at execution time.
Although I understand what SQL Injection is and how SQL Injection can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.