If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example:
```$unsafe_variable = $_POST['user_input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");
```
That's because the user can input something like ```value'); DROP TABLE table;--```, and the query becomes:
```INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
```
What can be done to prevent this from happening?
Let's analyze the problem more closely and come up with a few solutions.

## Prepared statements
Prepared statements provide a way to define the SQL query template and then bind the user input as placeholders. When a query is executed for the first time, its structure is inspected and its placeholders are transformed into identifiers. When user input is subsequently supplied, it's treated as literal data rather than arbitrary SQL code. This way, an SQL injection can be prevented.
The most common solution is to use prepared statements or parameterized queries instead of the direct SQL injection, like this:
```const QUERY = "INSERT INTO `table` (`column`) VALUES (?)";
$stmt = $db->prepare($QUERY);
$stmt->execute([$unsafe_variable]);
```
Or, in the case of MySQLi:
```$stmt = $conn->prepare("INSERT INTO