#       Instruction: call str($string) when you wanted get data by POST OR GET OR   #
#            REQUEST method befor using for query.Only use with ASCII character.    #
#            For example:                                                           #
#               $id=$_GET["id"];                                                    #
#               $id=str($id);                                                       #
#               $SQL="SELECT * FROM table_name WHERE id=$id";                       #
#               //execute query at here                                             #
#              with like operation:                                                 #
#               $key=$_GET["keyword"];                                              #
#               $key=str("%$key%");                                                 #
#               $SQL="SELECT * FROM table_name WHERE keyword like  $key ";          #
#                //execute query at here

$id = "1'"; // có dấu nháy để test sql inj
$id = str($id);

$db->query("SELECT * FROM abc WHERE ID='$id'");