SQL injection is an attack technique where malicious SQL statements are inserted into entry fields of a web application to manipulate the backend database. This allows attackers to bypass authentication and access, modify, or delete database records.