[empath75]

So what to you do if you need to make a sql call based on user input?

[gnud]

Use parameters, of course. Using SQL parameters for untrusted input is the only sane way to avoid SQL injections.