Stored Procedures Vs. ... use the "escape" function on your statements to protect from inline SQL. The PHP escape function ensures that any malicious characters are "escaped" from the statement.