title: A better SQL string sanitization function
body: <p>I am currently using below function to sanitize my $_POST and $_GET against SQL injection. Unfortunately, I cannot post code through it, for example: "<code>&lt;a href  test</code>". How does Twitter do it? </p>
  
  <pre><code> function _secinput($variable)
   {return filter_var(mysql_real_escape_string($variable), FILTER_SANITIZE_STRING); }
  </code></pre>
  
  <p>Plus, can anyone tell suggest me if I can improve it in any ways?</p>