You use PDO and prepared statements. Although realistically, you are going to be using a framework and some kind of Active Record pattern.