title: SQL Injection with backslash
body: <p>This is sample code:</p>
  
  <pre><code>include("db_connect.php");
  //
  function foo($string){
      $s_array = array("'", '"');
      $result = str_replace($s_array, "\\", $string);
      return $result;
  }
  //
  $first_var = $_POST['first_var'];
  $second_var = intval($_POST['second_var']);
  //
  $first_var_result = foo($first_var);
  //
  mysql_query("UPDATE some_table SET first_column='".$first_var_result."', second_column='".$second_var."'  WHERE id='id'");
  </code></pre>
  
  <p>When $_POST['first_var'] equals ', <strong>foo</strong> function replaces <strong>'</strong> with \ and mysql returns ERROR.
  <strong>This is not my code</strong>. I'm simpe interested in if this code is vulnerable (SQL Injection)? Thanks.</p>