Use $mysqli->real_escape_string