Executing queries throws an error because of a Apostrophe : <p>I've been developing a website and since the beggining I've been thinking of how to solve this problem.</p>

<p>So here it is:</p>

<p>My website as alot of input fields, and with that, I came to notice that if a user uses <code>'</code> there's an <code>SQL error</code>.
    I've search for similiar problems and i did not find any, but I believe I might be searching the wrong way. </p>

<p>This is how I execute my queries:</p>

<p>I created a function for my queries:</p>

<pre><code>function query($sql) {  
    $stmt = $conn-&gt;prepare($sql);
    $stmt-&gt;execute();
}
</code></pre>

<p>And then I use it like this:</p>

<pre><code>$sql = "INSERT INTO users(fname,lname,username) VALUES('$fname','$lname','$username')";
$stmt = $dbconn-&gt;query($sql); // $dbconn is the variable of my db connection class
</code></pre>

<p>I thought about using str_replace to replace the <code>'</code> with a <code>\</code> but then if a user uses <code>\</code> then it will be converted to a <code>'</code> and it's not that great of a solution.</p>
