how to pass input field value into sql query as parameter in php(run time)

$sql="SELECT S.SLOCATIONCODE FROM SUBLOCATION S INNER JOIN LOCATION L ON L.LOCATIONID = S.LOCATIONNAME WHERE (L.LOCATIONCODE = '$loca' OR '$loca' ='ALL' ) UNION ALL SELECT 'ALL' FROM DUAL";