Write a piece of code to prevent SQL injection:

$servername = "localhost";

$username = "user";

$password = "123456";

if(isset($_POST["uname"], $_POST["upass"])) {

$conn = new mysqli($servername, $username, $password);

if (!$conn->connect_error) {

die("Connection failed: " . $conn->connect_error); }

$query = "select * from user where uname='$_POST[uname]' AND upass='$_POST[upass]'";

$result = $conn->query($query);

}

?>