How to prevent SQL injection attacks?
Use an ORM or a framework
Add \ before every ' and " in user input
\
'
"
Use prepared statements
Upgrade regularly the database server