Special Characters

If you are using MySQLi then you can use something that's called a prepared statement. e.g:

$stmt = $dbConnection->prepare('SELECT * FROM movies WHERE title = ?');
$stmt->bind_param('s', $title);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do something for each returned $row
}

Here you are a preparing a statement to get all columns from the table movies where the column title is equal to the php variable $title.

On the second row (bind_param) you are "replacing" or binding the question-mark (?) of the statement with that variable. The s means that the variable you are binding is a string.

Next, on the third row, you are executing that statement, and then store it in $result.

bind_param() will secure your database from first-level injections which is in most cases a sufficient measure.

you can also use mysqli_real_escape_string() around the value before inserting it into the database