It isn't as big of a deal at the moment, but it is always good to make sure everyone is aware of this and how dangerous it can be. There is some very good information on it located on MSDN here. The important part is to remember that anytime you take input from an external source (someone typing on a web page), they don't always have to put in what you expect.
The safest way to keep yourself safe from SQL Injection is to always use stored procedures to accept input from user-input variables. It is really simple to do this, for example, this is how you don't want to code things:
var Shipcity;
ShipCity = Request.form ("ShipCity");
var sql = "select * from OrdersTable where ShipCity = '" +
ShipCity + "'";
This allows someone to use SQL Injection to gain access to your database. For example, imagine if someone put in the following for the "ShipCity":
Redmond'; drop table OrdersTable--
This would delete the entire table! If you have seen much on SQL Injection, they have figured out all kinds of ways to get information about your database or server, so don't think they can't find the names of tables, etc.
The correct way to do this would be using a stored procedure as follows:
Go to the complete details ...