Take your query:

[Code]
select * from tableName where userField = '" + txtBoxUser + "' and passField = '" + txtBoxPass + "'"
[/code]

So, imagine user enter this on textboxes:
txtBoxUser: John Doe
txtBoxPass: 1234

So, the query will be:

[Code]
select * from tableName where userField = 'John Doe' and passField = '1234'
[/code]

If the user/pass matches, the login will succes.

[B]But now[/B] imagine the [I]'user'[/I] enter this on textboxes:

[PHP]
txtBoxUser: ' or ''='
txtBoxPass: ' or ''='
[/PHP]

The query will be:

[Code]SELECT * FROM tableName WHERE userField = '' OR ''='' AND passField = '' OR ''=''[/code]

This query [B]always[/B] successfully, so [B]login always sucess[/B]

So you have 3 choices:

1) Only allow letters and numbers on textboxes. (really bad fix, because someone could use simbols on user/pass)
2) Use [B]parameters[/B] on query. This should fix the SQLi
3) Use [B]Stored Procedures[/B]

Hope it helps someone to understand how 'SQL Injection' works and how try to fix it