Why is a query such as SELECT ... WHERE user_id = '$id' vulnerable when $id comes directly from a request?
SELECT ... WHERE user_id = '$id'
$id
Unvalidated input is concatenated into SQL, so it can change the query's syntax
Putting the value between single quotes automatically makes it safe
Every SQL SELECT statement allows arbitrary operating-system commands
SELECT
The variable name $id is reserved by the database