SQL injection is a security risk that occurs when the content entered by a user is transferred to a server and directly injected into the SQL code for execution.