Injection Protection

From RMBwiki

One method for protecting against SQL injection.

<?php
  $queryBase = <<<QB
    INSERT INTO people ('name', 'email', 'phone') VALUES ("%s", "%s", "%s")
QB;

  $query = sprintf($queryBase,
                   mysql_real_escape_string($_POST['name']),
                   mysql_real_escape_string($_POST['email']),
                   mysql_real_escape_string($_POST['phone'])
                  );

  // $query is now safe to pass to mysql_query()
?>