First, you have no way to avoid people using curl to access the API. On the server perspective, your application and someone using curl or telnetting in is exactly the same.
You must employ some controls and protections on the API that will make harder to people just fire up curl and mess with you database. As you are learning, I will not give you links, but the things you must research. A few options come to mind:
First of all, learn how to secure code. PHP is very easy to learn, and at the same time is very easy to make deadly mistakes. Learn how to secure code is the first thing you must learn before doing anything. Write secure code from the start, not "make it work" first and try secure it later. Make it secure from the start.
You must employ HTTPS. It gives you server authentication, confidentiality and protects against accidental or intentional changes on the traffic. Pair it with public key pinning and you set a high barrier.
If you have anything private, you must authenticate the users. Salted passwords, secure sessions and secure cookies come to mind. Even a captcha. Employ rate-limiting on the login too, so it will be harder to someone bruteforce the login.
Input validation and sanitization
This is very important. No matter how secure is the controls around the API, if someone can slips a SQL injection, you are dead. All your users are dead, all your data is dead. If someone can exploit a remote file include, you are even deader than before. So never trust anything you receive from the client, even if the client is authenticated.
Study the OWASP guides and tutorials, specially the Top 10 vulnerabilities. Try not to expose your application to that risks.