PHP/MYSQL Prevent sql injection attacks function -

i want upgrade , make more systematic, protection against sql injection attacks. gather 3 main methods pdo, prepared statements , mysql_escape_string, pdo considered best mysql_escape_string considered adequate if meticulous. don't think ready go pdo or prepared statements have lot of complicated queries involving multiple tables huge task. want make use of mysql_escape_string more programmatic.

rather escape every individual variable users submit, thinking of escape sql commands standard function might require modification handle punctuation sound approach or escaping whole query create problems-i use apostrophes, backticks , %, example. seem standard function every sql statement more systematic , standard variable variable approach. question modifications handle punctuation might needed? also, there else ought go function such htmlspecialchars , strip_tags gather mysql_escape_string not 100% complete?

here basic function.

function safe($sql) { $safesql = mysql_real_escape_string($sql); return $safesql; } 

i don't think ready go pdo or prepared statements have lot of complicated queries involving multiple tables huge task.

huge? perhaps. worth effort though.

will escaping whole query create problems

yes. function have no way of knowing if piece of sql injection attack or intended.

you have escape text @ point inserted sql. can't insert text sql , figure out bit sql , bit text afterwards.

is there else ought go function such htmlspecialchars , strip_tags

strip_tags throws data away. wouldn't use it.

both strip_tags , htmlspecialchars offer protection against unsafe data being inserted html document. use them before inserting data html document, not before inserting data sql.