There are two implementations of a query() function, demonstrating how to prevent sql injection. One uses the mysql functions. The other uses PDO.
To use this function is simple. First, you set up your sql string and values. Notice the placeholders match the array keys:
$sql = 'SELECT * FROM someTable WHERE someValue = :someValue AND anotherValue = :anotherValue';
$values = array(
'someValue' => 'Hello',
'anotherValue' => 'World',
);