Escape string before inserting in a query

You can use that one or query binding.
I find it easier to use the latter.

PHP Code:

$query = $this->db->query("SELECT * FROM `PM_board` WHERE `lesser_id` = ?
UNION
SELECT * FROM `PM_board` WHERE `greater_id` = ?",array($owner,$owner));