That's still using "unclean" values naked. Mysqli has a prepared statement function that will do the necessary escaping for you.
PHP:
$query = mysqli_prepare($databasehandle, "INSERT INTO users (Username, Password) VALUES (?, ?)"));
mysqli_stmt_bind_param($query, "ss", $user, $password);
mysqli_stmt_execute($query);
The "ss" indicateed that both of the parameters you are binding to the staement are strings. From there, you can either get the number of affected rows (for insert, update or delete operations) using
mysqli_stmt_affected_rows() or get read results using
mysqli_stmt_fetch().
It's a heck of a lot easier, though, to write and maintain the code if you use PDO, since you can use named parameters rather than trying to figure out or remember which question mark stands for which value. Yes, it's object-oriented, but it's really pretty easy. You can start with
this tutorial, and the documentation at php.net is always worth reading (and a lot of extra information is in the comments section to each of the entries). There is no good reason not to use PDO in preference to MySQL Improved
unless you are using MySQL-only database features (hint: you probably won't be doing that) or are trying to quickly update a large, old codebase.
