Use prepared SQL statements with mysqli to avoid SQL injection.