It happens when you build SQL by concatenating strings. The defense is parameterized queries ($1): the values travel separately from the SQL text, so they can never be read as SQL.
SQL injection
An attack where user input becomes part of the SQL text and changes its meaning.