If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example:
```$unsafe_variable = $_POST['user_input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");
```
That's because the user can input something like ```value'); DROP TABLE table;--```, and the query becomes:
```INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
```
What can be done to prevent this from happening?
One solution is to use prepared statements with placeholders instead of inserting user input directly into queries. With placeholders, the database driver can escape any user input being inserted:
```$unsafe_variable = $_POST['user_input'];
$stmt = $pdo->prepare("INSERT INTO `table` (`column`) VALUES (:value)");
$stmt->bindParam(":value", $unsafe_variable);
$stmt->execute();
That's a great question.

One common practice to prevent SQL injection is called prepared statements. When using prepared statements, the query is split into two pieces, a string representing the structure of the query, and a number of placeholders for values that will be inserted into the query later. The placeholders have specific formats, and the values to be inserted are then prepared, and bound to the placeholders, ensuring that the query will be executed as intended, no matter the user input.