Use prepared statements to prevent SQL injection.

[SQL Injection][0] is one of the most common web application vulnerabilities,
in which an attacker is able to execute arbitrary queries on your database.
Any time you directly use user input in a query, you are vulnerable to SQL
injection.

For a humorous explanation, see [xkcd's Exploits of a Mom][1] and [this
explanation][2] of the comic.

There are [many ways][3] to prevent SQL injection in PHP.  I chose the most
direct transition - from mysql to mysqli with prepared statements.

This is a public service provided by [The Programmer Education Foundation][4],
an organization of volunteers seeking to educate fellow developers about common
critical, but easily-correctable, errors.

[0]: http://en.wikipedia.org/wiki/Sql_injection
[1]: http://xkcd.com/327/
[2]: http://bobby-tables.com/about.html
[3]: http://bobby-tables.com/php.html
[4]: http://programmer-education-foundation.github.io/