How to prevent SQL injections in PHP? Safe work with MySQL

Hello everyone. I'm a beginner PHP developer and I have a serious security problem. I'm writing a simple user registration site, but I'm not sure if my code is protected against hacking.\n\nHere's an example of my login code:\n\n```php\n$username = $_POST['username'];\n$password = $_POST['password'];\n$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";\n$result = mysqli_query($connection, $query);\nif (mysqli_num_rows($result) > 0) {\n echo "Welcome, $username!";\n} else {\n echo "Invalid login or password";\n}\n```\n\nI've heard that such code is vulnerable to SQL injections. For example, if you enter `' OR '1'='1` in the username field, you can bypass the password check. How do I properly protect my application? Do I need to escape quotes using