In order to send data to a databse securely use prepared statements otherwise 
you can get attacked by an SQL Injection easily.
----
https://www.w3schools.com/php/php_mysql_prepared_statements.asp