Questions about SQL injection in PHP

Questions about SQL injection in PHP
I made a little forum myself, and I stumbled across a shot that could be injected. For example: http://localhost/BBS/detail.php?articalID=4

The goal is: to display the article ID 4 post, I now add such a sentence after the sample: Http://localhost/BBS/detail.php?articalID=4 or 1=1, returned the result is all the posts are displayed, Then I saw a function on the Internet:

PHP Code

  
  function Safe ($string) {return "'". Mysql_real_escape_string ($string). "'";}

, the result of using a custom function after the error, this mysql_real_escape_string can give a detailed usage?

How to prevent injections?

------Solution--------------------

PHP Code

function Safe ($string =null) {return addslashes ($string);}
------Solution--------------------
Generally, the value of the integer type obtained by the external (post,get) is used before the intval () conversion, and the string type plus the mysql_real_escape_string () filter is available.

Recommend a related document on the IBM website:
