Basic conclusion of this tutorial is to wrap your variables that you are passing to a query with mysql_real_escape_string(). Even then, I've read stuff that mysql_real_escape_string() isn't 100% secure. There's other stuff you can do to filter strings and such. There's talk about using stored procedures, but I've seen where stored can be overkill and end up slowing query down.
Basic conclusion of this tutorial is to wrap your variables that you are passing to a query with mysql_real_escape_string(). Even then, I've read stuff that mysql_real_escape_string() isn't 100% secure. There's other stuff you can do to filter strings and such. There's talk about using stored procedures, but I've seen where stored can be overkill and end up slowing query down.