Here are a few possibilities to get the conversation started:
- Escape all input upon initialization.
- Escape each value, preferably when generating the SQL.
The first solution is suboptimal, because you then need to unescape each value if you want to use it in anything other than SQL, like outputting it on a web page.
The second solution makes much more sense, but manually escaping each value is a pain.
I’m aware of prepared statements, however I find MySQLi cumbersome. Also, separating the query from the inputs concerns me, because although it’s crucial to get the order correct it’s easy to make a mistake, and thus write the wrong data to the wrong fields.
as @Rob Walker states, parameterized queries are your best bet. If you’re using the latest and greatest PHP, I’d highly recommend taking a look at PDO (PHP Data Objects). This is a native database abstraction library that has support for a wide range of databases (including MySQL of course) as well as prepared statements with named parameters.