I think anybody even remotely involved with databases these days has seen the xkcd comic about Bobby Tables : http://xkcd.com/327/
Basically, the comic warns against SQL injection, and reminds you to sanitize your database inputs rather than blindly append incoming data to queries. There are more elaborate discussions about this concept in these articles on MSDN, and of course your favorite search engine will have many results as well:
Books Online : SQL Injection
MSDN Mag : Stop SQL Injection Attacks Before They Stop You
It is important to remember, though, that not all injection attacks are intended to screw up your database or gain unauthorized access to your data. Some vectors are a little more subtle, and while the damage isn't always as severe, it is still something you need to be aware of to prevent fraudulent activity or even just to keep egg off your face. I'll illustrate with two examples:
Letting customers dictate your pricing
I remember several years ago, I demonstrated to an online shop why they shouldn't add items to a shopping cart by passing (among other things) price information in the query string. I showed them how I was able to buy a bunch of T-shirts at $0.01 each, and encouraged them to verify whether my cart would have gone through like that. As it turned out, it would have. For pointing out this fundamental flaw, they added a free t-shirt to my order, and eliminated the shipping charge. I am curious how quickly they would have caught this - or if some folks even got away with it unnoticed - had I not pointed it out. I think it would be really hard to trace back and prove the buyer to be at fault.
Letting customers change your messaging
This morning, fellow MVP Simon Sabin (@simon_sabin) pointed out that Toyota Ireland had a similar flaw in a site used for their recent recall issues. Basically you could change their message to you . Now arguably this doesn't really harm anyone (because you are only able to change your own messaging), except it was fun to get a screen shot of something like this before they fixed the exploit (remarkably quickly, I might add):
click to embiggen
Summary
So just as a reminder, when you're accepting input from users, validate and sanitize! And when you're accepting input from your own site, make sure it really comes from your site - there is no reason to expose contextual information in the query string, as this just invites users to tinker. Unless you have a really good reason to use QueryString parameters, protect your data and variables by passing them via post or session.