php如何防止SQL注入

<?php /************************* 说明： 判断传递的变量中是否含有非法字符 如$_POST、$_GET 功能： 防注入 **************************/ //要过滤的非法字符 $ArrFiltrate=array("'",";","union","add"); //出错后要跳转的url,不填则默认前一页 $StrGoUrl="http://localhost/news.php?id=46"; //是否存在数组中的值 function FunStringExist($StrFiltrate,$ArrFiltrate){ foreach ($ArrFiltrate as $key=>$value){     if (eregi($value,$StrFiltrate)){         return true;     } } return false; } //合并$_POST 和 $_GET if(function_exists(array_merge)){     $ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS); }else{     foreach($HTTP_POST_VARS as $key=>$value){         $ArrPostAndGet[]=$value;     }     foreach($HTTP_GET_VARS as $key=>$value){         $ArrPostAndGet[]=$value;     } } //验证开始 foreach($ArrPostAndGet as $key=>$value){     if (FunStringExist($value,$ArrFiltrate)){         echo "<script language=/"javascript/">alert(/"非法字符/");</script>";         if (empty($StrGoUrl)){         echo "<script language=/"javascript/">history.go(-1);</script>";         }else{         echo "<script language=/"javascript/">window.location=/"".$StrGoUrl."/";</script>";         }         exit;     } } ?>