sql injection means injecting a query in database the always retun true.So it allow to login with false credentials.For example: use
' or '1'='1
in place of username and password and it will logged you in.
If sql injection is not prevented.
It can be prevented by implementing a check during login.
$user=mysql_real_escape_string($_REQUEST['user']);
$pass=mysql_real_escape_string($_REQUEST['pass']);
Thats all.Clean n simple.
