PHP: Prevent SQL Injection

stop_sql_injection.php

$sql = safeInput("UPDATE table_name SET field_one='%s', field_two='%s' WHERE id='%s'", $input);

function safeInput($string, $args){
  
  foreach( $input as $key => $value ){
     // 'clean' the input
     $args[$key] = mysql_real_escape_string($value);
  }
  // add the statement as the first element of the array
  $args[0] = $string;

  return call_user_func_array('sprintf', array(&$a));
}