PHP - Mysql Injection Protection

im having some robots injecting gibberish

i wnat to deny amy links in the requesttext of the form
for some reason i tested it and it accepted a http link
Code: [Select]
if (preg_match("/http/i","$RequestText")){ exit();}

thanks

<?php
include ("database.php");
// show comments
$result = mysql_query("SELECT * FROM gamecomments");
while($row = mysql_fetch_array($result))
  {
  echo $row['username'] . ": <Br> " . $row['comment'];
  echo "<p>";
}
      ini_set ("display_errors", "1");
      error_reporting(E_ALL);
      

      
      if (isset($_POST['submit'])) {
         
      
         
           // now we insert it into the database
   $insert = "INSERT INTO gamecomments (username, comment)
   VALUES ('[$username]', '$_POST[comment]')";

   $add_comment = mysql_query($insert);
{
 echo "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=games.php\">";
  }
 }

I haven't had a problem with sql injection yet, but I'm scarred to death. 

I didn't do any form data validation as I was building my site. I'm just now starting to learn how.

Magic_quotes is turned on at my host.
I know about htmlspecialchars and mysql_real_escape_string and stripslashes and htmlentities.
In testing each of these, it seems they all miss one thing or another.

so, I created an array of words and characters that I can't for the life of me imagine anyone would ever need on any form in my site, that I THINK addresses most if not all of the really bad things. But hey... I'm new to this. So here is my array and using print_r() it looks pretty good.

Code: [Select]
$badstuff = array('select','delete','update','insert','drop','=',';','"','\'','<','>','/');
Code: [Select]
Array ( [0] => select [1] => delete [2] => update [3] => insert [4] => drop [5] => select [6] => delete [7] => update [8] => insert [9] => drop [10] => = [11] => ; [12] => " [13] => ' [14] => < [15] => > [16] => / )

My str_ireplace() function works fine within the code, but I'd like to create a function using str_ireplace(). I am failing miserably.

Here is my function that doesn't work...
Code: [Select]
function strip($string){
return str_ireplace($badstuff,"",$string);
}

Here below..... the first line, that uses the function does NOT work.
The second line that just uses str_replace() function works fine.

Code: [Select]
echo strip($string).'<br>';
echo str_ireplace($badstuff,"",$string)

Can anyone tell me why my function does not work? I've read and watched 20 tutorials and just can't see the problem.

Thanks for any input.
 

'[$username]' is using a variable from a cookie varifying that you are logged in, this code works except i need to put real escape strings and protection from mysql injection and dont really know where to put them.

Code: [Select]
if (isset($_POST['submit'])) {

        // now we insert it into the database
$insert = "INSERT INTO gamecomments (username, comment)
VALUES ('[$username]', '$_POST[comment]')";

$add_comment = mysql_query($insert);
{
 echo "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=games.php\">";
  }
 }
[CODE]

i am using a Anti MySQL Injection my friend made for me

config.php
//Anti MySQL Injection
function anti_injection($sql) {
   // removes words that contain sql syntax
   $sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
   $sql = trim($sql); // strip whitespace
   $sql = strip_tags($sql); // strip HTML and PHP tags
   $sql = addslashes($sql); // quote string with slashes
   return $sql;
}

<?php 
include "./config.php";
$title = $_POST[title];
$type = $_POST[type];
$episode = $_POST[episode];
$year = $_POST[year];
$genre = $_POST[genre];
$status = $_POST[status];
$summary = $_POST[summary];
$pictures = $_POST[pictures];
$title = anti_injection($title);
$type = anti_injection($type);
$episode = anti_injection($episode);
$year = anti_injection($year);
$genre = anti_injection($genre);
$status = anti_injection($status);
$summary = anti_injection($summary);
$pictures = anti_injection($pictures); ?>
When i enter the data from the text box and click submit

it still puts the data in to the date base but it shows

]Notice: Use of undefined constant title - assumed 'title' in C:\wamp\www\studying\take 2\addin11.php on line 41

Notice: Use of undefined constant type - assumed 'type' in C:\wamp\www\studying\take 2\addin11.php on line 42

Notice: Use of undefined constant episode - assumed 'episode' in C:\wamp\www\studying\take 2\addin11.php on line 43

Notice: Use of undefined constant year - assumed 'year' in C:\wamp\www\studying\take 2\addin11.php on line 44

Notice: Use of undefined constant genre - assumed 'genre' in C:\wamp\www\studying\take 2\addin11.php on line 45

Notice: Use of undefined constant status - assumed 'status' in C:\wamp\www\studying\take 2\addin11.php on line 46

Notice: Use of undefined constant summary - assumed 'summary' in C:\wamp\www\studying\take 2\addin11.php on line 47

Notice: Use of undefined constant pictures - assumed 'pictures' in C:\wamp\www\studying\take 2\addin11.php on line 48

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

Deprecated: Function sql_regcase() is deprecated in C:\wamp\www\studying\take 2\config.php on line 30

And thanks to the Anti MySQL Injection my Primary key in my database dont work :s
can you help? thank you