Your framework probably has a dedicated library or interface to make database queries through that avoids SQL injections. In Django for example, database queries are usually made through a ORM, or object relational manager that precludes SQL injection in the first place.

In general SQL statements should never be concatenated with user input. SQL injections occur when unescaped user output is put into a SQL statement. It is unwise to attempt to write an escape function yourself, as there are many caveats and edge cases which someone else has probably already written or you. For this reason it's best to rely on the idiomatic pattern or library for your language or framework for database access, rather than rolling your own solution.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence