A través de tweako (visto hace algunos minutos en menéame) llegué a un artículo -en inglés- que explica como protegerse de ataques de Inyección de SQL con PHP. En el mencionado artículo, en la última parte aparecen las siguientes dos porciones de código:

<?php

# Ok, so I'm going to oversecure a query to the database that selects an article 
# by using the given article ID. 
# Here is the code.

//Database connection is present
//Make sure that the id is actually given

if (isset($_GET['id']))
{
	$id = $_GET['id'];
}
else
{
	die('Please provide an article ID');
}
 
//Make sure that its an integer
if (is_integer($id))
{
	die('Please enter a valid article ID');
}
 
//Validate that its in between the ranges 1 and 10,000
if ($id < 1 || $id > 10000)
{
	die('Please enter a valid artile ID');
}
 
//Construct the query
$SQL = "SELECT * FROM posts WHERE postID = '".$id."'";

echo $SQL; // Línea agregada

?>
<?php

# This next one will validate a username before its entered into the database.

//Database connection is present
//Make sure that the id is actually given
if (isset($_GET['username']))
{
	$username = $_GET['username'];
}
else
{
	die('Please provide a username');
}
//Get the length of the username
$length = strlen($username);
//Validate the length
if ($length < 3 || $length > 20) // parte modificada
{
	die('Please enter a username between 3 and 20 characters long');
}
//Make sure that its safe to enter the database.
$username = mysql_real_escape_string($username);
//Construct the query
$SQL = "SELECT * FROM username WHERE username = '".$username."'";
//Show the username
echo 'Username: '.stripslashes($username);
//Send the query and close the connection to the database

?>

Los códigos mostrados ¿son correctos? si no es así, ¿qué errores tiene?.