SQL Injection is in the top 10 OWASP and Common Weakness Enumeration. Using MySQL and PHP, show a very short and simple application that is vulnerable to this attack.
Provide another version that mitigates this issue. (Again keep this simple)
Students should respond with specific tests (e.g. data input) that shows how they could break into your database application with your first example but were unsuccessful for your mitigated example.