<p>If user input is inserted without modification into an SQL query, then the application becomes vulnerable to <a href="https://stackoverflow.com/a/332367/">SQL injection</a>, like in the following example:</p>

<pre class="lang-php prettyprint-override"><code>$unsafe_variable = $_POST['user_input']; 

mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");
</code></pre>

<p>That's because the user can input something like <code>value'); DROP TABLE table;--</code>, and the query becomes:</p>

<pre><code>INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
</code></pre>

<p>What can be done to prevent this from happening?</p>

I'd recommend using
PDO
(PHP Data Objects) to run parameterized SQL queries.
Not only does this protect against SQL injection, but it also speeds up queries.
And by using PDO rather than
```
mysql_
```
,
```
mysqli_
```
, and
```
pgsql_
```
functions, you make your application a little more abstracted from the database, in the rare occurrence that you have to switch database providers.