Prepared statements done right ($mysqli->prepare outside of loops)