my friends website got hacked, the hacker leak all of the database data using SQLMAP from
http://example.com/users/users.php?id=3 what methods exist in php to avoid writing vulnerable code like this?
Welcome to Security.SE. The issue isn't
sqlmap, but SQL injection.
What is SQL Injection?
SQL injection is a vulnerability that allows an attacker to control the data in and out of the database. This is how your friend's site was broken in to.
How do I protect against SQL injection?
The universal fix is to use parameterized queries. How this is done depends on the language that is used. For PHP, the PDO library supports this.