SQL injection consists of inserting SQL into user input to hijack a query built by concatenation, in order to read, modify or delete data. The main defense is to use prepared statements with parameters, never concatenation of external data.
Example
// Dangerous
$sql = "SELECT * FROM users WHERE id = $id";