title: Handling SQL request with parameters and avoiding SQL injection
body: <p><strong>This question is quite open ended. Maybe it doesn't belong here, so sorry in advance if that's the case.</strong></p>
  
  <p>I'm using SQL in a real project for the first time, and I'm having some issues. I'm also using php and javascript.
  In the web app I'm currently writing, i do a lot of SQL query to my MySQL database. Each one of these query do a different thing, on different tables, etc. </p>
  
  <p>At the moment, I'm doing the following : each time i do a query in the client side code, I'm passing a parameter I defined myself to the server. </p>
  
  <p>On the server, I wrote a switch on this parameter. So it looks like this :</p>
  
  <pre><code>if (parameter == 1)
      /*Query 1*/
  else if (parameter == 2)
      /*Query 2*/
  etc.
  </code></pre>
  
  <p>It's not very convenient. However, if i use a function writing a SQL query by taking parameters from the client, it would be subject to SQL injection.</p>
  
  <p>So to sum it up : how do i create a SQL query in the most "modular" way possible and still avoid SQL injection ?</p>
  
  <p>I already know about prepared statement, but if i get it right, i can't write a full SQL query with only prepared statement.</p>