How to prevent sql injection in php

How to prevent sql injection in php !

SQL injection mean if any  user can send his own custom query to our database. SQL  injection is the most common problem when newbie or non-professional programmers develop websites.

For example : Here is a sql command

SQL injection Threat

$user=$_POST[‘username’];
$pass=$_POST[‘password’];

Select * from tablename where user=$user and Pass=$pass