It's not too uncommon to see poor code examples in questions where a user hasn't escaped their user inputs in one way or another.
mysql_query("INSERT INTO foo VALUES ($_POST['bar'], $_POST['baz'])");
and this question: Update Mysql column field based on email address
This is often the first thing I notice about a post, and even though most of the time it's not part of the initial problem, I feel it needs to be mentioned - some might argue it's more important than answering the question.
What is the best thing to do in this situation? It's almost like we should have a short url to link to, or an FAQ page with these common pitfalls on.