That's right – parameter binding is the way to go. There is also an old way which also correctly escapes parameters but is easier to get wrong by forgetting to

That's right – parameter binding is the way to go. There is also an old way which also correctly escapes parameters but is easier to get wrong by forgetting to add it somewhere, which is using your database library's function to escape input before concatenating it into a directly-executed SQL string. Here are some examples of those methods – in PHP, because it’s the only language I’ve used to build a site without an ORM (which is another option). It’s been a while since I used PHP, but as far as I can tell, with PHP’s built-in library, you would use PDO (PHP Data Objects) for parameter binding. For escaping input for SQL strings, you would use mysql_real_escape_string() (or its relative for your database engine).