What about if we use encryption prior to running a sql insert or select statement.

$username=encryptMe(mysql_real_escape_string($_POS T['username']));
$password=encryptMe(mysql_real_escape_string($_POS T['password']));
$sql="Insert into users (username, password) values ('username','password');


Then shouldn't it turn the bad sql "or 1=1" into something unrecognizable by our database. Then we just decrypt something when we need to display it back?

$usernametodisplay=decryptMe($row['username');