sql injections/best practises

I'm am trying to find some definitive best practises on database connections with php on both mysql and oracle.   I'm starting to redesign a corporate website and am trying to find out more about security and the best practises for database queries and user input form handling.   For example - what's the best usage - prepared statements? And does it have to be php 5? I need preferably a one stop shop as opposed to looking at dozens of different places. Can you advise a particular book? Website?   I have checked out the security area on the php manual and some users notes - some were useful. But it didnt really have a lot of info and I dont think it is comprehenive or all inclusive.   Thanks in advance. PS I would like to switch the current site from jsp to php. I was going to look into Zend IDE. Comments? Suggestions?   thanks