To prevent malicous requests/attempts validate and sanitize user submitted data. When sanitizing and validating take into consideration the following functions: mysql_real_escape_string() (escape bad character, to prevent sql injection) preg_match() (validate data using an expression) intval() (ensure value is int)
always filter the user submitted data (requested). that means form the variable as the way you want. So you would prevent any malicious code user would submit..