I am Web developer , but i don't understand something , i did search and asked many but they know it is just there but the don't give me a technical answer:

Main Question :

How SQL Injection works through URL with SQL in parameter ?

Description :

Assume i have database and in the database i have table named mytable and when i get id from method POST i put it in this query

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if user put SQL like : SELECT * FROM mytable`

It became something like this: SELECT * FROM mytable WHERE id='SELECT * FROM mytable' So it just return :

You have an error in your SQL syntax

So i just think How these kind of attack works ?

How they change the query to pass Syntax Error ?