php - Sanitizing some SQL queries -

this question has answer here:

• how can prevent sql injection in php? 28 answers

what easiest , effective way sanitize this:

$q = "select * `admin` "  ."where `username`=' ".$_post["username"]."' "  ."and `passcode`=' ".$_post["password"]."' "  

also, learning php if please provide explanations, tips, suggestions, or more ways clean stuff prevent sql injections appreciated

i use $mysqli prepared statements - here example php site:

explanation (see bottom example using code):

you replace variables in query ? marks, , bind variables in @ later time.

$city = "amersfoort";  /* create prepared statement */ if ($stmt = $mysqli->prepare("select district city name=?")) {      /* bind parameters markers */     $stmt->bind_param("s", $city);      /* execute query */     $stmt->execute();      /* bind result variables */     $stmt->bind_result($district);      /* fetch value */     $stmt->fetch();      printf("%s in district %s\n", $city, $district);      /* close statement */     $stmt->close(); }  /* close connection */ $mysqli->close(); 

---

example using code:

$q = "select * `admin` "  ."where `username`= ? , passcode = ?";   /* create prepared statement */     if ($stmt = $mysqli->prepare($q)) {          /* bind parameters markers */         $stmt->bind_param("ss", $_post['username'], $_post['password']);          /* execute query */         $stmt->execute();          /* bind result variables */         $stmt->bind_result($district);          /* fetch value */         $stmt->fetch();  // can while($stmt->fetch()){ code here }          printf("%s in district %s\n", $city, $district);          /* close statement */         $stmt->close();     }      /* close connection */     $mysqli->close();