title: Where to use mysql_real_escape_string to prevent SQL Injection?
body: <p>I'm in trouble with a group of hackers. they hacked my client's site few times, and my client gets more angry :( my client lost his database (which has hundreds records), and had to enter all :( </p>
  
  <p>now I'm following some more introductions;</p>
  
  <ul>
  <li>fixed file permissions</li>
  <li>changed ftp and host login info</li>
  <li>cleared all remote mysql accesses</li>
  </ul>
  
  <p>now working on SQL Injection issue. I added mysql_real_escape_string to admin panel login paramaters. So where else should I use this mysql_real_escape_string ? I have few email forms at site, I dont think i need to add there...</p>
  
  <p>I have an index.php as a mainpage. Should I do anything for this page to prevent any sql injection attack via url like <code>index.php?somesql=</code> ?</p>
  
  <p>Please advise me! I appreciate so much!!! :(</p>
  
  <hr>
  
  <p>for example:</p>
  
  <p>I have such code;</p>
  
  <pre><code>public function showDetails($id) {
  
      // SQL Jobs Details
      $this-&gt;sql_job = "SELECT * FROM jobs WHERE id=".mysql_real_escape_string($id);
      $this-&gt;rst_job = mysql_query($this-&gt;sql_job);           
      $this-&gt;row_all = mysql_fetch_assoc($this-&gt;rst_job);     
  
      // SQL State
      $this-&gt;sql_state = "SELECT title FROM state WHERE id=" . $this-&gt;row_all[$this-&gt;tbl_jobs['f4']];
      $this-&gt;rst_state = mysql_query($this-&gt;sql_state);   
      $this-&gt;row_state = mysql_fetch_assoc($this-&gt;rst_state);
  ........
  </code></pre>
  
  <p>is it enough to use mysql_real_escape_string for $id . not for $this->row_all[$this->tbl_jobs['f4']] </p>