Anti SQL Injection Login

<?php
// ---------------------------- Anti SQL Injection Login © made by CaFc Versace ---------------------------- \\
$inpohAing['host'] = "localhost";
$inpohAing['user'] = "CaFc";
$inpohAing['pass'] = "Versace";
$inpohAing['conn'] = mssql_connect($inpohAing['host'], $inpohAing['user'], $inpohAing['pass']);

function aingAntiHek($SQLi) {
    $SQLi = preg_replace(sql_regcase("/(from|union|select|order by|or|insert|delete|where|drop table|show tables|#|'|`|\"|\*|--|\\\\)/"), "", $SQLi);
    $SQLi = trim($SQLi);
    $SQLi = strip_tags($SQLi);
    $SQLi = addslashes($SQLi);
    return $SQLi;
}
//---------------------------------------------------------------------------------------------------------- \\

if (isset($_GET['action']) && ($_GET['action'] == "login")) {

    $userAing = aingAntiHek($_POST['user']);
    $passAing = aingAntiHek($_POST['pass']);
    $nyekrip  = md5($passAing);

    $hasil1   = mssql_query("SELECT * FROM account.dbo.user_profile WHERE user_id = '" . $userAing . "'");
    $ngitung1 = mssql_num_rows($hasil1);

    $hasil2 = mssql_query("SELECT user_pwd FROM account.dbo.user_profile WHERE user_id = '" . $userAing . "'");
    $baris2 = mssql_fetch_row($hasil2);

    if ($ngitung1 == '0') {
        echo '<br>Akun Anda tidak ada dalam database.';
    } elseif ($baris2[0] != $nyekrip) {
        echo '<br>Kata sandi salah. Silahkan coba kembali.';
    } elseif ($_GET['login'] != 'login' && $ngitung1 == '0') {
        echo '<br>Login gagal, mohon login kembali.';
    } else {

        //-------- KODEMU DISINI -------
        $_SESSION['user'] = $userAing;
        echo "<h3>Selamat datang " . $_SESSION['user'] . " piye kabare?</h3>";
        echo "<br />";
        //------------------------------
    }
} else {
    echo '<h2>Login cok!</h2><br />
          <form name="" action="' . $_SERVER['php_self'] . '?action=login" method="post">
            Name: <input type="text" name="user" maxlength="16"><br />
            Password: <input type="password" name="pass" maxlength="16"> <br />
          <input type="submit" value="Login!">
          </form>';
}
?>