title: PHP MySQL vulnerability
body: <p>I use this function for preventing SQL injection</p>
  
  <pre><code>  function cleanQuery($string)
  {
    if(get_magic_quotes_gpc())  // prevents duplicate backslashes
    {
      $string = stripslashes($string);
    }
    if (phpversion() &gt;= '4.3.0')
    {
      $string = mysql_real_escape_string($string);
    }
    else
    {
      $string = mysql_escape_string($string);
    }
    return htmlentities($string);
  }
  </code></pre>
  
  <p>and i use it like that </p>
  
  <pre><code>$sql = "select * from news where id = ".cleanQuery($id)." ";
  </code></pre>
  
  <p>the query should be safe when calling the page.php?id=1
  however when adding ' to the end of URL like that page.php?id=1' it gives error</p>
  
  <p><strong>Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource</strong></p>
  
  <p>that means the page is still having a vulnerability i think, any body has a solution ?</p>