Yes, its called a SQL injection attack.
Link to some info:
https://www.acunetix.com/websitesecurity/sql-injection/
It all depends on how the application is written as to whether there is a vulnerability or not.
On a basic level you can execute extra commands. Like drop table
or add extra table info / modifications.

