How will this affect chances of preventing SQL injection?

If you use PDO you don't have to worry about escaping data (in this situation): $stmt = $pdo->prepare('SELECT article_name FROM table WHERE user_id = :userid AND post_id = :postid'); $stmt->execute(array( ':userid' => $userid, ':postid' => intval($_GET['id']) //Just to be safe )); // You could also do this instead (thanks @Digital Precision) //$stmt->bindValue(':postid', $_GET['id'], PDO::PARAM_INT); //$stmt->execute(array(':userid' => $userid)); while($row = $stmt->fetch()) { //Work with data } For more on PDO see the http://www.php.net/pdo. The problem with using http://www.php.net/mysql_real_escape_string is that as its name suggests it only escapes strings. It escapes the characters that can be used to terminate a string so that an attacker can't close a string and enter malicious SQL. If you are stubborn and refuse to use PDO, you could use a function like http://www.php.net/intval on any unsanitized integers to ensure they contain only numbers. $post_id = intval($_GET['id']); //Now $post_id can only be a number

Not sure what you mean by "I was told one way to do sql injections was to use 1=1 where someone can see all entries that don't belong to them". 1=1 always evaluates to true. I've only ever seen this done when the query being generated by the application has only conditional where clauses with no root where clause. Not sure what it has to do with protecting you from sql injections.

Your query would look like: Select article_name from table where user_id=$userid and post_id=\'\' OR \'1\'=\'1\' As other mention while i typing this, it is better to quote your values. So you will have: Select article_name from table where user_id=$userid and post_id='\'\' OR \'1\'=\'1\'' This returns nothing, if there is not a post with such id. So your query will not return every post from the current user. But keep in mind to quote your values.