php中如何避免sql注入攻击

if(!get_magic_quotes_gpc()){
callUserFunc(
___FCKpd___0
GET,"addslashes");
callUserFunc(
___FCKpd___0
POST,"addslashes");    
}
就可以了,字段值加 " 就可以了,如查询文章
"SELECT * FROM table WHERE id="$id""