If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example:
```$unsafe_variable = $_POST['user_input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");
```
That's because the user can input something like ```value'); DROP TABLE table;--```, and the query becomes:
```INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
```
What can be done to prevent this from happening?
That's a great question.

One common practice to prevent SQL injection is called prepared statements. When using prepared statements, the query is split into two pieces, a string representing the structure of the query, and a number of placeholders for values that will be inserted into the query later. The placeholders have specific formats, and the values to be inserted are then prepared, and bound to the placeholders, ensuring that the query will be executed as intended, no matter the user input.
Let's analyze the problem more closely and come up with a few solutions.

## Prepared statements
Prepared statements provide a way to define the SQL query template and then bind the user input as placeholders. When a query is executed for the first time, its structure is inspected and its placeholders are transformed into identifiers. When user input is subsequently supplied, it's treated as literal data rather than arbitrary SQL code. This way, an SQL injection can be prevented.