Take your query:

select * from tableName where userField = '" + txtBoxUser + "' and passField = '" + txtBoxPass + "'"

So, imagine user enter this on textboxes:

txtBoxUser: John Doe
txtBoxPass: 1234

So, the query will be:

select * from tableName where userField = 'John Doe' and passField = '1234'

If the user/pass matches, the login will succes.

But now imagine the 'user' enter this on textboxes:

txtBoxUser: ' or ''='
txtBoxPass: ' or ''='

The query will be:

SELECT * FROM tableName WHERE userField = '' OR ''='' AND passField = '' OR ''=''

This query always successfully, so login always sucess

So you have 3 choices:

1) Only allow letters and numbers on textboxes. (really bad fix, because someone could use simbols on user/pass)
2) Use parameters on query. This should fix the SQLi
3) Use Stored Procedures

Hope it helps someone to understand how 'SQL Injection' works and how try to fix it