I'm on the other side going "Yup, that's about right. At least they QA'd this time."

Basic SQL injection

The -- makes anything after it into a comment which is ignored by the database. This prevents the remainder of the original command from making the whole thing invalid.

SQL syntax.

So imagine your website has such (very naïve) server logic:

sql_stmt = "SELECT UserID, Username FROM Users WHERE Username = '"
                + form.fields["username"]
                + "' AND Password = '"
                + hash_password(form.fields["password"])
                + "';";
execute_sql(database, sql_query)

If you put '; DROP TABLE Users; -- as a username in the form, then the statement gets compiled as the following:

SELECT UserID, Username FROM Users
WHERE Username = ''; DROP TABLE Users; -- ' AND Password = '###########…';

Since -- marks the beginning of a comment line, it effectively neuters the statement and makes it drop (delete) the Users table.

Some people would gain admin privilege by adding stuff like UPDATE TABLE Users SET IsAdmin = 1 WHERE Username = 'wakkablam'; thus promoting user Wakkablam to administrator status or so.

Some poking around might be necessary to guess the structure of tables or such.

How do you test if Mr. Customer can launch the calculator utility? What if it launches, but the user only sees dicks? I joke, but GUIs are hard to work with sometimes and can do weird things, and I don't know how you can test that outside of whether or not it crashed. "It worked fine on my machine."