SQL injection occurs when untrusted input changes the structure of a query instead of remaining data.