Mysql and php fixes to replicate PDO security -

i understand using pdo makes sql injections virtually impossible. however, don't have time @ moment change database related code in our website. (especially since i'm new @ pdo, there's learning curve involved). want know mysql/php functions give same security pdo does.

will these 2 points enough?

1. making sure $_get , $_post data of type expected (such product ids should numerical, use is_numeric).
2. using mysql_real_escape_string.

or there else should do? way website is, based on id=x in query string, things might go database. , saw after hack in database, things can go database through query strings had been compromised values cd etc/pwd.

the short version: move mysql extension mysqli extension, , replace queries take parameters prepared statements (here quickstart guide).

but in long run, learning right pdo won't take long , is worth effort.

as side note:

i understand using pdo makes sql injections virtually impossible.

that not true, possible write injectable query in pdo. code in pdo bad in old mysql extension (two vulnerabilities vector price of 1 here !):

$pdo_obj->query("select password users id = '".$_get['id']."'"); 

pdo provide tools protect , make them easy use. always, have take care of validating , filtering input yourself. prepared statement, can @ least let database know supposed parameter, , supposed part of query.