PDO. You write the query and insert the variables in a second step. I’ve been doing php 10+ years and that’s all we’ve been using. Or if your framework has an orm you can use that.

There are pdo drivers for most popular databases

https://www.php.net/manual/en/book.pdo.php

Honestly it’s my favorite way of accessing databases (compared with Java Perl and python)

All top frameworks support parameter binding. Same for PHP standard library like PDO or mysqli which also provide parameter binding.

These eliminate SQL injection. But you have to use them and not just concatenate user input to SQL queries.

Using prepared statements, with the PDO database driver it would be something like this

  $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)');
  $stmt->execute([$email]);
    

For a full example you can look here, includes injection example

https://3v4l.org/Fh2Pt

That really depends on whether you are using raw PHP or a CMS, CMF, or application framework. If it's any of the latter you should check with the development team. In many cases there are some great tools already provided for you by the frameworks, or there are helpful conventions that make things more efficient.

If it's raw PHP I wouldn't want to compete with a lot of great SO results out there, but you also have to take into account circumstantial matters, like whether the given approach is appropriate to the needed output or input you are dealing with.

For this reason I'd recommend arranging for some kind of code review even if you ask online strangers for input.

Last I looked, it was to leverage the $mysqli->real_escape_string method.