title: Prevent HTML insert into MySQL Table
body: <p>I've coded a little comment function on my website by PHP. I have noticed that there is a huge security risk. Users can write some HTML/PHP/MySQL and insert it into the table. Is there a easy way to prevent this?</p>
  
  <p>This is my PHP insert script:</p>
  
  <pre><code>&lt;?php
      if ( $_SERVER["REQUEST_METHOD"] == 'POST' ) {
      $kommentar_neu = $_POST["kommentar"];
  
      if (!empty($kommentar_neu)) { 
          $order = "INSERT INTO $db_kommentare
          (kommentar, teilnehmer, kommentardatum, projektnummer)
          VALUES
          ('$kommentar_neu', '$teilnehmer_name', '$zeiteingabe', 
           '$projektnummer_hw_order')";
      }
      }
  ?&gt;
  </code></pre>