SQL injection is an attack exploiting vulnerabilities in a web application’s database layer, allowing attackers to execute arbitrary SQL code. It can be prevented by using prepared statements, stored procedures, parameterized queries, and regular audits and tests of the web application.