title: Protecting PHP against MySQL injections
body: <p>I'm a total PHP noob, and while I read up on MySQL injections and protecting my script, I thought I would post what I have so far here.</p>
  
  <p>Below is my current (working, yet bad practice) code. Can someone offer up my weak spots, and what I can do to fix?</p>
  
  <pre><code>&lt;?php
  require_once 'login.php'; //database information
  
  $db_server = mysql_connect($db_hostname, $db_username, $db_password)
      or die("Unable to connect to MySQL: " . mysql_error());
  
  mysql_select_db($db_database)
    or die("Unable to select database: " . mysql_error());
  
  $email = $_POST['email'];
  
  $sql="INSERT INTO users (email)
  VALUES ('$email')";
  
  $result = mysql_query($sql);
  
  if($result){
  header('Location: ../thankyou.php');
  }
  else {
  echo "ERROR";
  }
  
  mysql_close();
  ?&gt; 
  </code></pre>