In PHP what will be your choice to preventing SQL injections Prepared Statements or an Escaping Strategy and why?

in classic PHP htmlspecialchars is a good choise.

but its better to use codeigniter builtin security functions.

good luck

We better use regex in the fields

my best strategy is working with node.js and run it in my server