If you want to see why you should always use prepared statements in your code, take a look at this [1]. Old and outdated, but still very much applicable.

[1]: http://technewsgalore.com/site/04/15/sql-injection-tutorial-...