To prevent yourself with sql injection, use mysql_real_escape_string

/* Quote variable to make safe
* Added on Aug 10, 2007 */
function quote_smart($value)
{
// Stripslashes because our get_magic_quotes_gpc is on
if(get_magic_quotes_gpc()) {
$value = stripslashes(trim($value));
} else {
$value = trim($value);
}

// Replaces empty string to NULL - what is the benefit of putting NULL value?
//if($value == '') $value = 'NULL';
// Real_escape_string
$value = "'" . mysql_real_escape_string($value) . "'";
return $value;
}

/* Quote Variable to make it safe - array */
function quote_smart_arr ($arr) {
foreach( $arr as $key => $list ) {
$list = & $arr[$key]; // Re-assign the variable
$this->quote_smart($list);
unset($list); // Break the link to the object so that foreach doesn't copy the next one on top of it.
}
}