What is SQL injection and how do you prevent it?

Untrusted input is concatenated into a SQL query, letting an attacker change the query. Prevent it with parameterised queries / prepared statements, least-privilege database accounts and input validation.

python cur.execute("SELECT FROM users WHERE id = %s", (userid,))