Basic SQL Injection Prevention

<?php

// Connection String here
$con = new mysqli("localhost", "root", "", "database"0;

// For example, you have an ID value in your $_GET
$id = $con->real_escape_string($_GET['id']);

// Your Query
$con->query("SELECT * FROM users WHERE id = $id"); // You use the variable $id where the content is already escaped instead of calling $_GET['id'] directly