Suppose you have a variable called $foo that may contain various SQL-like stuff. Do this:
$foo = mysql_escape_string($foo);
mysql_query("select * from table where foo = '$foo'");
You'll note there are single quotes around $foo in the SQL query. This tells MySQL where the string starts and ends.
The [man]mysql_escape_string/man bit handles single-quotes inside the string itself, prefixing them with backslashes. That way if you have a string like "isn't" then your query will look like this:
select * from table where foo = 'isn\'t'
The backslash lets MySQL know that the quote that follows is part of the string, not the end of it.
You may already have backslashes in the string, if the "magic quotes gpc" setting is enabled (it is by default).
I prefer to turn off magic quotes, and then use a database abstraction layer that supports placeholders (I use my own, though PEAR does support placeholders).
It you don't do it right, it is actually a security vulnerability. Google for "sql injection" for more info.
