there are also other languages available, but i think this is the most popular
Better yet, use prepared statements: change statement to "... WHERE something=:something ...". PHP code looks like:then you can use it later for your php, just change the WHERE something='something' to something='".$value."' like that...
$stmt = $db->prepare('... WHERE something=:something ...');
$stmt->execute(array(':something', $value));