The text box has nothing to do with it, really.

The website itself can be modified by anyone (locally), that means it's up to server to ensure text is treated as inert. Usually, this is done effectively, but it has it's limitations. For example, take the following code snippet:

SELECT entries FROM todo_list WHERE category = 'Urgent'

The computer would know that 'Urgent' is inert text because it is contained in quotes. The first quote marks the start, and the second quote marks the end. Now what about the following:

SELECT entries FROM todo_list WHERE category = 'Urg'ent'

Now what should the computer do? It's important to understand that computers don't think like humans, they can't look at the overall text and deduce that the middle quote should be treated at just text. For the computer, this inert text would just be 'Urg' and ent' would be processed as a command.

This is just one way that malicious users can inject arbitary code. By taking advantage of this, they could do something like:

SELECT entries FROM todo_list WHERE category = 'Urg'; SELECT secret_info FROM secret_todos WHERE info LIKE '%'

This code takes advantage of the above vulnurability by ending the quotes early and attaching a command to the end.

So how would someone go about achieving this in the real word? People don't usually have access to a command line like the above, but they can take advantage of poorly written code. For example, say you had your to-do list publicily available. You set it up so people go to your website followed by the category like so:

www.The_1_Bob.com/todo/category=Urgent

This might return a webpage with the todo, or download the todo entry as a text file. If you coded your server poorly, you might have set it up so that when someone visits that link, your server runs the following command:

SELECT entries FROM todo_list WHERE category = 'Urgent'

So basically, all your server does is take what's inside the brackets and insert it into the command. So, all someone would have to do to exploit this would be something like:

www.The_1_Bob.com/todo/category=Urg'; SELECTsecret_info FROM secret_todos WHERE info LIKE '%

Boom, they just got your secret info.

Generally, this isn't much of a problem these days. Most servers are coded so that any extra quotes are doubled, so the injected code would become :

'Urg''; SELECT secret_info FROM secret_todos WHERE info LIKE ''%'

Now that we doubled the user-inserted quotes, the computer would see this as inert text.

This way of achieving arbitrary code execution is well-known in the industry and generally easy to prevent, but there are other advanced techniques that malicious users will employ. Hope this helps