Code Exp

This method is more secure

$conn = Connection::getConnectionInstance();

    if ($conn->connect_error) {
        die("<b>[Connection failed:]</b> " . $conn->connect_error);
    }

    // prepare and bind
    $stmt = $conn->prepare("INSERT INTO myTable (String1, String2, Num1, Double1) VALUES (?, ?, ?, ?)");
    $stmt->bind_param("ssid", $var_string1, $var_string2, $var_num1, $var_double1);

    $var_string1= "Hello world";
    $var_string2= $_POST['txt_box_input'];
    $var_num1= 12345;
    $var_double1= 1.540;

    $stmt->execute();

    // $new_order_id = $stmt->insert_id;
    $_SESSION["user_char_id"] = $stmt->insert_id;

    $stmt->close();
    $conn->close();

---

Resource:

https://www.php.net/manual/en/mysqli-stmt.bind-param.php

https://www.w3schools.com/php/php_mysql_prepared_statements.asp