Valid injection is an issue, wildhoney uses sprintf to secure it form that. I find the best way it to wrap all values in single quotes and table names, ect. in `. For instance
"SELECT * FROM user WHERE id = $id"
Would be
"SELECT * FROM `user` WHERE `id` = '$id'"

That way, even if $id = "99999 OR id > 0"; it wont inject anything.

Dont use stripslashes, there are valid uses for slashes and that would simply remove them all.

__________________