How to prevent an app against SQL injection using prepared statements for each SQL query.

I have some "manager" classes that handle queries and call static methods from a specific class designed for database connexion and query running. This one creates a connexion for each query and has some generic public static methods getAll(), getOne(), exec() to treat all kinds of queries.

Where can I do the db->prepare, BindParam, and execute statements ? Manager class side, no connexion initialized, so db->prepare is impossible.
Database class side, the method are generic so parameters are variable depending on the method calling the static method.

To have a clearer idea of what I'm trying to explain here, you can see my code here : <https://github.com/code-climber/car_rental/tree/master/src/car_rental/model/dao>

You can check the way I write my SQL queries in CarManager.class.php and the way they are treated in DBOperation.class.php.

I hope this problem will clear important concepts in my mind in OOP PHP programming.