Need help about sql injection

Hello,
I am going to develop new websites and also have some information about sql injection but do not know about how to stop it. I have code like this
mysql_query("select * from user where username ='".mysql_escape_string($user_name)."' ");

is it enough to protect from mysql injection or have to do more if yes then Plz tell me about it's next step
Thanks in advance

See original post by beven