mysql 인젝션(injection) 방어

<?php
// Quote variable to make safe
function quote_smart($value)
{
	// Stripslashes
	if (get_magic_quotes_gpc()) {
		$value = stripslashes($value);
	}
	// Quote if not integer
	if (!is_numeric($value)) {
		$value = "'" . mysql_real_escape_string($value) . "'";
	}
	return $value;
}

// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
	OR die(mysql_error());

// Make a safe query
$query = sprintf("SELECT * FROM users WHERE user=%s AND password=%s",
	quote_smart($_POST['username']),
	quote_smart($_POST['password']));

mysql_query($query);
?>

출처 : http://hoooow.tistory.com/m/post/151