 <p>So in other words, your query is vulnerable with <code>SQL Injection</code>. Better use <code>PDO</code> or <code>MySQLi</code> Extension since you tagged `PHP.</p> <p>Take time to read on this article: <a href="http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php"><strong>Best way to prevent SQL injection in PHP?</strong></a></p>