Read the links you have given properly.
The solution to the problem is written in the link
1.
Use the prepared statement class to fix the sql injection vulnerability & filter sql error requests.
Set error(0) to prevent against information disclosure via exceptions or error reports.
2.
Parse the input fields and restrict characters like () > < \ / etc to prevent against script inclusion.
Parse also the vulnerable output sections were the script code is getting executed out of the module context.
To Make a prepared statement
$oDB=new PDO('..your connection.. ');
$hStmt=$oDB->prepare("select * from users where id=:id");
$hStmt->execute(array(':id',$userID));
Notice above that $userID is not combined with the SQL string therefore an SQL injection will not work on it.
Using mysqli_real_escape_string
Note that mysql_real_escape_string has been depreceated so instead I'll mention how to use mysqli_real_escape_string
$a= "'ABCD"; //will not work because of quotation
$a= $mysqli->real_escape_string($a);
//Now this is the string with special chars escaped
For more information read
PDO How can I prevent SQL injection in PHP?
Escaping Strings http://php.net/manual/en/mysqli.real-escape-string.php
