[Vineman]

I have recently been having threats of SQL injection being performed on parts of a website of mine. I have protected all forms with htmlspecialchars();, but is this enough? How can I make sure SQL querys wont execute if sent in (its a radio site with a request system and such)?

[Patiek]

There are several ways to protect yourself.

You can use mysql_real_escape_string() to escape mysql input to add protection against SQL injection. Take a look at their examples.

Some other useful articles I just found searching google:
http://en.wikibooks.org/wiki/Program...:SQL_Injection
http://www.imperva.com/application_d...injection.html

The PHP function I listed will help you out immensely. Also, checking each variable for proper formatting will also help (such as using is_numeric to check IDs, etc).

[moonkey]

you may also use magic_quotes which removes suspicious chars