How can PHP be used to create a secure web application to prevent SQL injection

Question

I’m developing a web application using PHP, and I’ve read a lot about the dangers of SQL injection attacks. 

I’m currently using raw queries like this in my code:

$query = "SELECT * FROM users WHERE username = '$user_input'";

I know this is vulnerable to SQL injection, but I’m unsure about the best way to secure my application against such attacks. What are the best practices in PHP to prevent SQL injection? Should I be using prepared statements or something else? Any code examples would be helpful to understand how to properly implement security in my SQL queries.