I explained that in an SQL Injection attack, an attacker typically inserts malicious SQL queries into input fields such as login forms, search boxes, or data entry points where user input isn’t properly validated. This allows unauthorized access or manipulation of the database.