SQL injection is a type of web application security vulnerability that allows attackers to inject malicious SQL code into a web application's database. This can lead to unauthorized access, data theft, and even complete control of the database.