Originally posted here by sun7dots
Other thing is to filter all unwanted chars that can be input by the user.
You need to look up the characters you should be stripping out of your inputs to prevent this style of attack,{...}
This is actually the wrong way to do it as people tend to forget things or overlook stuff (the infamous "too many slashes syndrome" ).

You need to filter on the characters you want and drop everything else.