Secure database connection in PHP
You're asking the wrong question. The right question is "What should I use instead of query?" The answer is that if you want to reinvent the wheel, you should use prepared statements, and if you don't then you should use an ORM which uses prepared statements under the hood. Prepared statements allow you to pass in parameters and ensure that the escaping is done correctly. E.g. you would use "SELECT * FROM foo WHERE bar = ?" passing parameter "baz" rather than "SELECT * FROM foo WHERE bar = " . mysqli_real_escape_string("baz").