For the longest time, I\'ve been using the following basic formatting for SQL queries within my PHP:
$sql = \"SELECT * FROM `user-data` WHERE `id` = \'\".$id.\"\
PDO is a good, solid, secure solution that many frameworks build off of. If you're going to start from the bottom, PDO is a solid foundation.