title: How should I "sanitize" my data inputs to fight against SQL injections?
body: <p>I've been working on a project for a website idea, but I noticed that I can actually perform SQL injections on my site. This isn't good, because if I can, then anyone can. What's the "best" way to sanitize data inputs for a php site?</p>
  
  <pre><code>&lt;?php
  $servername = "localhost";
  $username = "myusername";
  $password = "mypassword";
  $dbname = "users";
  
  // Create connection
  $conn = new mysqli($servername, $username, $password, $dbname);
  // Check connection
  if ($conn-&gt;connect_error) {
      die("Connection failed: " . $conn-&gt;connect_error);
  } 
  
  $fname = $_POST['fname'];
  $lname = $_POST['lname'];
  $pnum = $_POST['pnum'];
  $cc = $_POST['cc'];
  $username = $_POST['username'];
  $password = $_POST['password'];
  
  $sql = "INSERT INTO Users (fname, lname, cc, pnum, username, password) VALUES ('$fname', '$lname', '$cc', '$pnum', '$username', '$password')";
  $result = $conn-&gt;multi_query($sql);
  
  if ($result-&gt;num_rows &gt; 0) {
      // output data of each row
      while($row = $result-&gt;fetch_assoc()) {
          echo "id: " . $row["id"]. " - Name: " . $row["firstname"]. " " . $row["lastname"]. "&lt;br&gt;";
      }
  } else {
      header('Location: registered.html');
  }
  
  $conn-&gt;close();
  ?&gt;
  </code></pre>