Use mysqli and bindings
see http://www.php.net/manual/en/mysqli.prepare.php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
// define your query
$query = "INSERT INTO tablename (column1,column2) VALUES (:col1,:col2)";
if ($stmt = $mysqli->prepare($query)) {
  // loop of insert
  for($i=0;$i<10;$i++){
    $stmt->bind_param("col1", $i);
    $stmt->bind_param("col2", 'test'.$i);
    $stmt->execute();
  }
  $stmt->close();
}else{
  throw new Exception("unable to prepare query");
}
$mysqli->close();
Binding will avoid a lot of security issue, no one should use something else then binding ever.
Even better put everything in a transaction and in case of error your database remains unchanged.
see: http://www.php.net/manual/en/mysqli.commit.php for more info
and here is a proposal with commit or rollback
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
if (mysqli_connect_errno()) {
  throw new Exception("Unable to connect");
}else{
  try{
    $mysqli->autocommit(FALSE);
    // define your query
    $query = "INSERT INTO tablename (column1,column2) VALUES (:col1,:col2)";
    if ($stmt = $mysqli->prepare($query)) {
      // loop of insert
      for($i=0;$i<10;$i++){
        $stmt->bind_param("col1", $i);
        $stmt->bind_param("col2", 'test'.$i);
        $stmt->execute();
      }
      $stmt->close();
    }else{
      throw new Exception("unable to prepare query");
    }
    $mysqli->commit();
  }catch(Exception $e){
    $mysqli->rollback();
  }
  $mysqli->close();
}
I did not try it but we should be near a good (best practice?) solution.
I hope this could help you.