How to prevent SQL Injection (WHERE clause)?

Question

How can I prevent SQL Injection in this case?

<?php

//==== GET URL PARAMETER
$urlParam =  $_GET['u'];
    
$sql = "SELECT email FROM `users` WHERE keystring = '$urlParam'";
$result = mysqli_query($conn, $sql);
    
$row = mysqli_fetch_array($result);