Understanding the Attack Vector
SQL Injection (SQLi) occurs when malicious user inputs are directly concatenated into active SQL query strings. A hacker can type strings that escape quotes and run arbitrary administrative commands.
The Solution: Prepared Statements
Prepared statements completely decouple query logic from data. The query schema is pre-compiled on the database engine, and then user input is bound purely as values, rendering insertion scripts entirely harmless.
$stmt = $conn->prepare("SELECT * FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();