Explain how this real injection attempt works
The classic SQL injection attack attempts to extract sensitive data through the user interface. This, however, seems to be poisioning your data by appending valid HTML to it. The attacker's assumption is that you trust data coming from the DB so are likely to embed it directly into your web app's output and thus display to your users links to their site.