MySQL injection attacks occur when the code of a MySQL query can be altered by the user due to improper escaping of variables.
See http://us3.php.net/mysql_real_escape_string for a great example of an SQL injection attack.
MySQL injection attacks can be prevented by using mysql_real_escape_string($mystring) for each variable inputted into a MySQL query.