This form of SQL injection occurs when user input is not filtered for escape characters and is then passed into a SQL statement.
This results in the potential manipulation of the statements performed on the database by the end-user of the application.