I was wondering is it possible to just my_sql_escape string the whole $_POST and $_GET array so you dont miss any variables?
Not sure how to test it or I would\'ve m
$escaped_POST = array_map('mysql_real_escape_string', $_POST);
Though, I would recommend using MySQLi instead.