Ping
IIRC from my PHP days, the default setup with MySQL pretty much killed any SQL injection attempt. In any case, I absolutely refuse to do inline SQL anymore (the most common PHP way of doing things). It's stored procedures and views, or I just won't do it.