just filter any characters like ' < > " and some words like select, delete drop etc... you can replace them with other characters and then when reading the sql data you can convert the characters back to the original characters.
@techcone: addslashes can easily be breaked, so it wont prevent from injections. @seogoat: You can use the function mysql_real_escape_string, that's made to prevent mysql injections.. mysql_real_escape_string($_POST[value])