If PHP's MySQL library supports it, you should be using bound variables. Gets rid of the SQL-injection worries.

Deploying Kanboard is about as easy as it gets. If you need an in-house project management tool, and you want one that’s as simple to use as it is to deploy, you can’t go wrong with Kanboard.