Via OWASP, a very nice primer on SQL injection.