What is sql injection?How to prevent it.

sql injection means injecting a query in database the always retun true.So it allow to login with false credentials.For example: use

' or '1'='1

in place of username and password and it will logged you in.

If sql injection is not prevented.

It can be prevented by implementing a check during login.

$user=mysql_real_escape_string($_REQUEST['user']);

$pass=mysql_real_escape_string($_REQUEST['pass']); 

Thats all.Clean n simple.