PHP mysql_* commands and safe them.

[SeaLife]

Hello!

 

Im Building my own Web Site (Demo: 2 ) and i wand to know how to make

 

mysql_query( $sql_query ) safe

 

 

im working with These Commands:

 

 

GetGet('q');

function GetGet($STRING) {
if(!isset($_GET[$STRING])) {
$return = "";
} else {
$return = sql_inj($_GET[$STRING]);
}
return $return;
}

GetPost('post:name');

function GetPost($STRING) {
if(!isset($_POST[$STRING])) {
$return = "";
} else {
$return = sql_inj($_POST[$STRING]);
}
return $return;
}

sql_inj( $string );

function sql_inj($sql) {
error_reporting (E_ALL ^ E_NOTICE ^E_DEPRECATED);
$sql = preg_replace(sql_regcase("/(from|<|>|'|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
$sql = trim($sql);
$sql = strip_tags($sql);
$sql = addslashes($sql);
$sql = htmlspecialchars($sql);
return $sql;
}

 

 

and now tell me, if i execute this, if it Safe:

mysql_query("UPDATE t_characters SET a_admin = ('".GetGet('adminlvl')."') WHERE a_nick = ('".GetGet('nick')."');");

 

 

 

 

THX