I said in my article someone would show me a better way and this is it - I'd never seen prepared statements before now, but you can bet I'll be using them from now on.
For anyone else who isn't sure what they are: prepared statements involves sending a template style query and parameters to the SQL api separately, eg:
query template: "select * from users where username = ?"
Parameter: "Matt"
The SQL api knows that one is a query and one is just a parameter so injection is impossible
