codes when getting and putting data to database, 

you should aware of  simple SQL injection prevention rules. 

So to prevent sql injection you should escape any variable

that you are going to use in the database accessing codes 

In the following code variable escaping shown as an example - 

$queryResult = mysql_query ("SELECT * FROM WHERE Example_table ex_field = \" " . mysql_real_escape_string( $ ex_field ) . " \ " " ) ;