PDO (PHP Data Objects) provides a consistent interface for accessing multiple database systems. Prepared statements, created with $pdo->prepare() and executed with bound parameters, separate SQL logic from data, preventing SQL injection.
Using placeholders (either ? or :name) instead of concatenating user input directly into SQL strings is the standard safe practice for all database queries.