Questions about SQL injection in php-php Tutorial

I made a small forum on the problem of SQL injection in php. I accidentally found that the injection was possible, for example: localhostBBSdetail. php? The purpose of articalID4 is to display the post with the article ID 4. now I add the following sentence: localhostBBSdetail. php? ArticalID4or11, the returned result is that all posts show questions about SQL injection in php.
I made a small forum myself and accidentally found that injection can be performed, for example, http: // localhost/BBS/detail. php? ArticalID = 4

The purpose is to display the post with the article ID 4. now I have added the following sentence: http: // localhost/BBS/detail. php? ArticalID = 4 or 1 = 1. the returned results are displayed in all posts. later, I saw such a function on the Internet:

PHP code

  function safe($string){return "'" . MySQL_real_escape_string( $string ) . "'";}

If the custom function is used, an error is returned. can this MySQL_real_escape_string be used in detail?

How to prevent injection?

------ Solution --------------------

PHP code

Function safe ($ string = null) {return addslashes ($ string );}
------ Solution --------------------
Generally, values of the integer type obtained by external (POST, GET) are converted using the prefix intval (), and values of the string type are filtered by mysql_real_escape_string.

We recommend a related document on the IBM website:
Four security rules that cannot be violated to ensure the security of PHP applications