What is SQL injection and how to prevent it?

-- Vulnerable code
query = "SELECT * FROM users WHERE email = '" + userInput + "'";

-- User enters: ' OR '1'='1
-- Resulting query:
SELECT * FROM users WHERE email = '' OR '1'='1';
-- Returns ALL users!

-- User enters: '; DROP TABLE users; --
-- Resulting query:
SELECT * FROM users WHERE email = ''; DROP TABLE users; --';
-- Deletes the entire table!

// Node.js with MySQL
const sql = 'SELECT * FROM users WHERE email = ?';
connection.query(sql, [userEmail], callback);

// Node.js with PostgreSQL
const sql = 'SELECT * FROM users WHERE email = $1';
client.query(sql, [userEmail]);

// Python with psycopg2
cursor.execute("SELECT * FROM users WHERE email = %s", (user_email,))

// Sequelize
User.findAll({ where: { email: userEmail } });

// Prisma
prisma.user.findMany({ where: { email: userEmail } });

// Knex.js
knex('users').where('email', userEmail);

// Validate input type and format
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (!emailRegex.test(userInput)) {
  throw new Error('Invalid email');
}

// Escape special characters (last resort)
const escaped = mysql.escape(userInput);