Grant Fritchey is a Microsoft Data Platform geek, an MVP and an AWS Community Builder. Grant works for Red Gate Software as a DevOps Advocate. Call: KC1KCE
The concept is simple. Your code allows someone to place additional SQL commands in it. That "injected" code enables data access and/or system hacking (depending on the security in place).
The problem, and the solution, has been well defined since 1998.
Simply put:
Parameterize the query
Escape the input
Have proper security in place
Use correct data types
In a nutshell. There's a ton more details, but that covers the basics.