you concatenate user input into a query string and someone closes your quote and appends a statement of their own.

SQL injection

Also calledparameterised query, prepared statement

An attack where untrusted input is interpreted as query syntax rather than data. The fix is parameterised statements, which separate code from data structurally rather than by escaping. Escaping by hand, blocklists and ORM usage that still builds strings all keep this alive decades after it was solved.