This is the query:
$mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '$my_country', `region` = '$my_region', `custom1` = '$mycust1', `custom2` = '$mycust2' WHERE `user_name` = '$me'");
What makes it vulnerable is the
$my_sound variable which isn't wrapped in the apostrophe ('). I've looked up many times on google but couldn't find much intel related to why SQL injections are doable when a variable in a query isn't wrapped in (')s.
How would an attacker exploit this query?