发送查询时我需要转义什么？

在PHP中，我正在使用此代码，对此我将不胜感激：

function quote_smart($valeur) { if (get_magic_quotes_gpc()) $valeur = stripslashes($valeur);

if (!is_numeric($valeur)) 
    $valeur = mysql_real_escape_string($valeur); 

return $valeur; 

}

$IdS = quote_smart($_POST['theID']); $sql = " SELECT * FROM Students WHERE IdStudent={$IdS}; "; 如果字段可以为NULL，则需要再次验证：

$picture = NULL; $theidyouwant = 7; $Name = 'WOOD';

if(is_null($picture)) $p = 'NULL'; else $p = "'".quote_smart($picture)."'";

$IdS = quote_smart($theidyouwant);

$requete = "SELECT * FROM Students WHERE IdStudent={$IdS} AND PictureStudent={$p} AND NameStudent='{$Name}'; ";