Use mysql_real_escape_string(), after you've connected to your database. If that function doesn't work, use mysql_escape_string() or addslashes(). Never leave your database input vulnerable to attack.
A database "query" is basically a "question" that you ask the database. The results of the query is the information that is returned by the database management system. Queries are usually constructed...
Database = Where you save your data (ex: if a user fill your registration form, entered data should be saved somewhere, that's database) Usually in PHP we use MySQL Database.