A quick search yields lots of posts on the subject, e.g.

• Simple question on SQL Injection
• Preventing SQL injection attacks: are -T and placeholders not enough?
• Preventing SQL injection attacks: Placeholders are enough for MySQL, Postgresql and SQLite

See also the links in Re^3: Preventing SQL injection attacks: Placeholders are enough for MySQL, Postgresql and SQLite for tools and papers.