title: Correct way to sanitize input in MySQL using PDO
body: <p>so I had a friend of mine try to run a SQLinjection on my site and he managed to get into it using the code underneath. How can I prevent this? I have read something about sanitizing the variables but how do I do this?</p>
  
  <p>';INSERT INTO login (username, password) VALUES ('Gjertsmells', 'password');SELECT 'password' FROM Login WHERE 'x'='x</p>
  
  <pre><code>$db = new PDO('mysql:host=XXXXXXXX;dbname=XXXXXXX', 'XXXXXXXXXX', 'XXXXXXXXX');
  
          // query MySQL to verify login
          $query = $db-&gt;prepare("SELECT password FROM login WHERE username='$username'");
          $query-&gt;execute();
  
          $column = $query-&gt;fetchColumn();
          if($column === $password)
  </code></pre>