How do i avoid sql injection in my queries?

Example:

-- Unsafe SQL query
SELECT * FROM users WHERE username = '$username' AND password = '$password';

Solution:

-- Use parameterized queries or prepared statements
-- Example in pseudo-code:
db.query("SELECT * FROM users WHERE username = ? AND password = ?", [username, password]);

To avoid SQL Injection, never directly concatenate or interpolate user inputs into your SQL queries. Instead, use parameterized queries or prepared statements.