To prevent SQL injection, use bound SQL variables instead of embedding user input in SQL queries. You will also gain performance.

To prevent xsrf attacks, check referer header before you take action.