พี่ๆ ช่วยหนูหน่อยเรืองความปลอดภัยค่ะ ของ code php ค่ะ กลัวโดน Injection

<?php
$sr = "host"; 
$user = "sa";
$pass = "123456"; 
$accdb = "account"; 
$acctab = "account"; 
$usercol = "id";  

function mssql_connect_ini($sr,$user,$pass) {
$mssql_connect = mssql_connect($sr, $user, $pass) or die ("<strong>เกิดข้อผิดพลาด</strong>");
	if ((strlen($sr) == 0) || (strlen($user) == 0) || (strlen($pass) == 0)) {
	echo "<strong>อิอิ</strong>";
	}
}

function mssql_account_ini($accdb) {
$mssql_select_db = mssql_select_db($accdb) or die ("<strong>เกิดข้อผิดพลาด</strong>");
	if (strlen($accdb) == 0) {
	echo "<strong>อิอิ</strong>";
	}
}


mssql_connect_ini($sr,$user,$pass);
mssql_account_ini($accdb);

$pusername = @$_POST['username']; 
$ppassword = @$_POST['password']; 
$prpassword = @$_POST['rpassword'];

if (isset($_POST['submit']) == true) {
$username = preg_replace("/[^a-zA-Z0-9\-\_\!\$\#\@\^\&\*\(\)\^\+\ \.\?]/", "", $pusername);
$password = preg_replace("/[^a-zA-Z0-9\-\_\!\$\#\@\^\&\*\(\)\^\+\ \.\?]/", "", $ppassword);

if ((isset($_POST['submit']) == true) and (strlen($pusername) < 3) || (strlen($pusername) > 15)) {
echo "ไอดีต้องมีความยาว3-15ตัวอักษร";
}

else if ((isset($_POST['submit']) == true) and ((strlen($ppassword) < 3) || (strlen($ppassword) > 15) || (strlen($prpassword) < 3) || (strlen($prpassword) > 15))) {
echo "รหัสผ่านต้องมีความ3ถึง15ตัวอักษร";
}

else if ((isset($_POST['submit']) == true) and ($ppassword != $prpassword)) {
echo "รหัสผ่านไม่ตรงกัน";
}

else if ((isset($_POST['submit']) == true) and (($pusername == $ppassword) || ($pusername == $prpassword))) {
echo "ไอดีและรหัสผ่านไม่สามารถเหมือนกันได้";
}

else if (mssql_num_rows(mssql_query("SELECT * FROM $acctab WHERE $usercol = '$username'")) == '0') {
$stmt = mssql_init('createaccount');
mssql_bind($stmt, '@account', strtolower($username), SQLVARCHAR, false, false, 15);
mssql_bind($stmt, '@password', strtolower($password), SQLVARCHAR, false, false, 36);
mssql_execute($stmt) or die ("<strong>เกิดข้อผิดพลาด</strong>");
mssql_free_statement($stmt);
echo "ID " . $username . " สามารถใช้งานได้แล้ว ";
} 
else {
echo "ID นี้มีอยู่ในระบบแล้ว.";
}
}
?>
<br>
<center>
<form method ="post" action="#">
  <div align="center">
    <table width="268" height="112" border="0" align="center">
      <tr>
        <td>ID</td>
        <td><input name="username" type="username"></td>
      </tr>
      <tr>
        <td>Password</td>
        <td><input name="password" type="password"></td>
      </tr>
      <tr>
        <td>RePassword</td>
        <td><input name="rpassword" type="password"></td>
      </tr>
    </table>
    <p><input name="submit" type="submit" value="สมัครสมาชิก">
      </td>
    </p>
  </div>
</form>
</center>