A website's SQL database stores all information from text boxes or forms on the website. SQL injection attacks can occur when a user inputs harmful characters into a text box, allowing them to access the entire database instead of just the desired information, as demonstrated in a search field for press releases.