Sneaking database commands into a web form or search box so the application runs them against its own database.