title: Deny user mysql inject
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php">How to prevent SQL injection in PHP?</a>  </p>
  </blockquote>
  
  
  
  <p>If user input is inserted into an SQL query directly, the application becomes vulnerable to SQL injection, like in the following example:</p>
  
  <pre><code>$unsafe_variable = $_POST['user_input'];
  
  mysql_query("INSERT INTO table (column) VALUES ('" . $unsafe_variable . "')");
  </code></pre>
  
  <p>That's because the user can input something like <code>value'); DROP TABLE table;--</code>, making the query:</p>
  
  <pre><code>INSERT INTO table (column) VALUES('value'); DROP TABLE table;--')
  </code></pre>
  
  <p>What should one do to prevent this?</p>