title: PHP PDO statement throwing fatal error
body: <p>I have a function which is throwing an unusual error regarding a syntax issue. Have a look.</p>
  
  <pre><code>public static function authenticate($_user, $_pass)
      {
          $sql = 'SELECT password, key 
                  FROM users 
                  WHERE username = ' . $_user;
  
          $stm = Db::init()-&gt;prepare($sql);
          if ($stm-&gt;execute())
              return $stm-&gt;fetch(PDO::FETCH_ASSOC);    
      }
  </code></pre>
  
  <blockquote>
    <p>Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key FROM users WHERE username = testuser1' at line 1' in /class.php:111</p>
    
    <p>Stack trace:<br>
    #0 /class.php(111): PDOStatement->execute()<br>
    #1 /class.php(118): Password::authenticate('testuser1', 'test')<br>
    #2 {main} thrown in /class.php on line 111</p>
  </blockquote>
  
  <p>Any ideas as to what this means?</p>