PHP - Spam Injection Protection

How can you protect mysql injection? (from inserting different statements into the input field)

Thanks

<?php
include ("database.php");
// show comments
$result = mysql_query("SELECT * FROM gamecomments");
while($row = mysql_fetch_array($result))
  {
  echo $row['username'] . ": <Br> " . $row['comment'];
  echo "<p>";
}
      ini_set ("display_errors", "1");
      error_reporting(E_ALL);
      

      
      if (isset($_POST['submit'])) {
         
      
         
           // now we insert it into the database
   $insert = "INSERT INTO gamecomments (username, comment)
   VALUES ('[$username]', '$_POST[comment]')";

   $add_comment = mysql_query($insert);
{
 echo "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=games.php\">";
  }
 }

I haven't had a problem with sql injection yet, but I'm scarred to death. 

I didn't do any form data validation as I was building my site. I'm just now starting to learn how.

Magic_quotes is turned on at my host.
I know about htmlspecialchars and mysql_real_escape_string and stripslashes and htmlentities.
In testing each of these, it seems they all miss one thing or another.

so, I created an array of words and characters that I can't for the life of me imagine anyone would ever need on any form in my site, that I THINK addresses most if not all of the really bad things. But hey... I'm new to this. So here is my array and using print_r() it looks pretty good.

Code: [Select]
$badstuff = array('select','delete','update','insert','drop','=',';','"','\'','<','>','/');
Code: [Select]
Array ( [0] => select [1] => delete [2] => update [3] => insert [4] => drop [5] => select [6] => delete [7] => update [8] => insert [9] => drop [10] => = [11] => ; [12] => " [13] => ' [14] => < [15] => > [16] => / )

My str_ireplace() function works fine within the code, but I'd like to create a function using str_ireplace(). I am failing miserably.

Here is my function that doesn't work...
Code: [Select]
function strip($string){
return str_ireplace($badstuff,"",$string);
}

Here below..... the first line, that uses the function does NOT work.
The second line that just uses str_replace() function works fine.

Code: [Select]
echo strip($string).'<br>';
echo str_ireplace($badstuff,"",$string)

Can anyone tell me why my function does not work? I've read and watched 20 tutorials and just can't see the problem.

Thanks for any input.
 

'[$username]' is using a variable from a cookie varifying that you are logged in, this code works except i need to put real escape strings and protection from mysql injection and dont really know where to put them.

Code: [Select]
if (isset($_POST['submit'])) {

        // now we insert it into the database
$insert = "INSERT INTO gamecomments (username, comment)
VALUES ('[$username]', '$_POST[comment]')";

$add_comment = mysql_query($insert);
{
 echo "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=games.php\">";
  }
 }
[CODE]

Hey,

Wondering if this would work, it is based on the idea that everyone who is a real visitor will be using a browser, is that correct? Do robots use browsers too? if so, it wont work! haha.

<?

$browser = mb_substr($_SERVER['HTTP_USER_AGENT'], 0, 31);

if   (!empty($browser)){echo '<form action="send.php" method="post">';}
   
?>

Just thought it was nice and simple, and couldnt see anywhere if it would work or not...