query() calls may be harmful for in terms of security

[mfatihsaglam]

Use PDO

$result = $connection->prepare("sql query string");
$result->execute();

instead.