Sql Query Injection

Sql Query Injection:
is a technique used to pass some conditions as the query string
Like if the password is checked by the query from code the encrypted password and the user name will be send to the database as the query string ,
So if is returns null then the remaining operation will be failed

So we can return a true value by passing a always true statements
Like
select 'rubin' as uname ,'done' as process where 1<2
This will be always true
So we use stored procedures to avoid such problems
And by validation the query string by adding an security module by the user we can avoid this query injection