SQL 注入获取 id 解决方案

我不知道如何使这段代码安全。我尝试在查询变量中使用mysql_real_escape_string，例如

$query = "select * from products where id= " . mysql_real_escape_string($products);

但没有奏效，还试图在产品变量中转义，但得到了相同的结果。有什么建议吗？谢谢。

<?php
/ Define vars.
$conn = mysql_connect('localhost', 'test', 'test');
$products = isset($_GET["products"]) ? $_GET["products"] : "";
$query = "select * from products where id=$products";
// List elements.
if ($conn)
{
	mysql_select_db('testsqli');
	$result = mysql_query($query);
	
	// Table head.
	echo '<table cellspacing="5" cellpadding="5">';
	echo '<tr>';
	echo '<td>Description</td>';
	echo '<td>Price</td>';
	echo '</tr>';
	
	// Empty table?
	if (@mysql_num_rows($result)==0)
	{
		echo '<tr>';
		echo '<td><i>That''s all!</i></td>';
		echo '</tr>';
	}
		// Listing data in table.
		while ($row = @mysql_fetch_array($result))
		{
			echo '<td>'.$row['Description'].'</td>';;
			echo '<td>'.$row['Price'].'</td>';;
			
		}
	echo '</table>';
}
?>

$query = "select * from products where id='" . mysqli_real_escape_string($products)."'";
// or
$query = sprintf(
  "select * from products where id='%s'",
  mysqli_real_escape_string($products)
);

$stmt = $dbh->prepare("SELECT * FROM PRODUCTS WHERE ID=?");
$stmt->bindParam(1, $products, PDO::PARAM_STR|PDO::PARAM_INPUT_OUTPUT, 4000); 
// call the stored procedure
$stmt->execute();