If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example:
```$unsafe_variable = $_POST['user_input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");
```
That's because the user can input something like ```value'); DROP TABLE table;--```, and the query becomes:
```INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
```
What can be done to prevent this from happening?
To prevent SQL injection, it's necessary to use prepared statements (parameterized queries) or parameterized functions, or to escape special characters in user input.

In the first approach, the query string is constructed using placeholders for the input, e.g., `%s` or `?`, and then the user input is added as a separate parameter:
```$safe_variable = mysqli_real_escape_string($link, $_POST['
The most common solution is to use prepared statements or parameterized queries instead of the direct SQL injection, like this:
```const QUERY = "INSERT INTO `table` (`column`) VALUES (?)";
$stmt = $db->prepare($QUERY);
$stmt->execute([$unsafe_variable]);
```
Or, in the case of MySQLi:
```$stmt = $conn->prepare("INSERT INTO