There are multiple options obviously for PHP, and one should use the quoting option provided by the ORM or extension one is using.
The most common ways are either MySQL/MySQLi or though PDO.
<?php
//
//MYSQL
//
$conn = mysql_connect(/ AUTH /);
//The mysqli driver also provides mysqli_real_escape_string()
$result = mysql_query(sprintf(
"UPDATE users SET name = '%s'",
mysql_real_escape_string($_GET['name'])
));
//
//PDO (Multiple DB Backends)
//
$conn = new PDO(/ DSN /);
//PDO::quote(...) alters quoting style depending on the DB driver
//CAVEAT: PDO_ODBC does not properly implement the quote feature
$stmt = $conn->prepare("UPDATE users SET name = :name");
$stmt->execute(array(
':name' => $_GET['name'],
));
//Best practice to typecast values that should always be integers
$rows = $conn->query(sprintf(
"SELECT id, name FROM users WHERE id = %s",
$conn->quote((int)$_GET['id'], PDO::PARAM_INT)
));
?>
