Most SQL-injection articles set a horrible example for young programmers.
Here is a very typical “bad example” of why you need to escape user data before
it goes into SQL queries:
(ed. The symbol « is a line break that’s not in the real code.)
1. $username = $_POST[‘username’]; // username=
