Sloppy PHP coding -- use PDO
Inputing user submitted data the right way:
PHP: PDO - Manual
This is probably beyond the scope of your abilities but the developers creating the code for your API should know better.
This is a nice blog article in more layman terms:
a2z notes: Introduction to PDO
Here is a long read on the SQL injection vulnerabilities in PHP query language.
mysql - How can I prevent SQL-injection in PHP? - Stack Overflow