SQL Injection

function ProtectSQL($string)
{
	if(get_magic_quotes_gpc())
	{
		$string = stripslashes($string);
	}
	$string = htmlentities($string);
	$string = mysql_real_escape_string($string);
	return $string;
}