How do i prevent sql injection attacks with php and mysql?

It goes further than just making sure that you have a mysql_real_escape_string() in place. Try this: [PHP] function prepareInsert($value) { // Stripslashes if ( get_magic_quotes_gpc() ) { $value = stripslashes( $value ); } // Quote if not a number or a numeric string if ( !is_numeric( $value ) ) { $value = "'" . mysql_real_escape_string($value) . "'"; } return $value; } [/PHP] This should be called such as: [PHP] $insert_sql = mysql_query("INSERT INTO table VALUES(NULL," . prepareInsert($_POST['field']) . ")"); [/PHP] It will automatically check to see if it's a number and if not place the quotes in there for you. Just simplifies things. Another thing is when you are calling this value please use htmlentities() it works perfectly. Best of luck, Chad R. Smith

Also search for "1 = 1" and make sure you don't use it in your queries, since that string is a sure indicator that somebody is probing your forms for SQL injection vulnerabilities.