if i want to protect my db and my site from these injections, what are the general methods to be used ?
There are no "general methods", though generally you would use the appropriate escaping mechanism for your database vendor's brand of SQL, or your database API.
For example, if you use the PDO extension or the MySQLi extension, you would use prepared statements. This would automatically result in the bound variables being escaped.
If you use other extensions and the incoming variable is expected to be an integer, you would cast it to an int.
If you use the MySQL extension, you would use [man]mysql_real_escape_string/man. With the PostgreSQL extension, it would be [man]pg_escape_string/man. The SQLite extension has [man]sqlite_escape_string/man. More generally, you would double single quotes to escape them.
So yes, it depends on what you are using. I suggest just using PDO.
