This I believe would not protect against SQL injection but I could be wrong bruh. The one the internets told me was mysql_real_escape_string. Besides that everything looks good!