Keyloggers are pretty simple. What they do is capture each keystroke your victim makes over a certain amount of time. This can be very useful if you want to get your friends password, or just see what they are tying in General. There are a bunch of keyloggers out there, some you have to pay for, some you don't, and some are Noob protected, meaning you have to crack the password.

SQL Injection is quite advanced. You have to know you're doing here. Okay, so you have 2 ways of injecting a website - Automatically (Done by a program like Havij) and Manual (Done by yourself). It is best you inject websites manually first, because if you inject a website with a tool and do not know anything, you won't learn anything.

Basically what you are doing is finding out if a website is vulnerable or not. If a website is vulnerable, you can extract important data from it, like CC info, passwords, and more. Once you've got into the control panel, you can delete everything and upload your defacement page, or you can inform the administrator of the website and who knows, he might reward you with some $$$.

What I suggest you do with this is hide behind either a Proxy or a VPN. This is because administrators can see which IP's have visited the site, and if he see's your original one, you might end up in jail. What a VPN/Proxy does is give you a whole new IP until you disconnect from it. This can save your ass from being raided by the cops.