title: Using Magento Methods to write Insert Queries with care for SQL Injection
body: <p>I am using the Magento's functionality to insert &amp; update queries. My requirement is that I want to take care of SQL Injection, when doing these types of queries. But I'm unable to find how Magento does this. I'm providing one start sample. Please provide me with one complete example.  </p>
  
  <pre><code>&lt;?php
  $write = Mage::getSingleton("core/resource")-&gt;getConnection("core_write");
  $sql = "INSERT INTO Mage_Example (Name, Email, Company, Description, Status, Date)
      VALUES ('$name', '$email', '$company', '$desc', '0', NOW())";
  ?&gt;
  </code></pre>
  
  <p>Now I want to change the above query to prevent the possible SQL Injection. I don't want to use the default "<code>mysql_real_escape_string()</code>" built-in function of PHP. Can anybody please provide me with one useful solution, using the "<code>$write</code>" DB Handler.  </p>
  
  <p>Any help is greatly appreciated.</p>