ถ้าเขียนสคริปแบบ oop ในการเพิ่ม ลบ แก้ไขข้อมูล จะสามารถป้องกัน SQL Injection ได้หรือไม่ครับ

<?php
// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
    OR die(mysql_error());

// Query
$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));
?>

<?php
// We didn't check $_POST['password'], it could be anything the user wanted! For example:

$_POST['username'] = 'aidan';
$_POST['password'] = "' OR ''='";

// Query database to check if there are any matching users
$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
//mysql_query($query);

// This means the query sent to MySQL would be:
echo $query;
?>

<?php
// We didn't check $_POST['password'], it could be anything the user wanted! For example:

$_POST['username'] = mysql_real_escape_string('aidan');
$_POST['password'] = mysql_real_escape_string("' OR ''='");

// Query database to check if there are any matching users
$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
//mysql_query($query);

// This means the query sent to MySQL would be:
echo $query;
?>