ขอคำแนะนำอธิบายการป้องกัน sql injection ด้วยครับ แบบระเอียด

<?
$viewid = ($_GET["view"]);
$idresult = mysql_query("SELECT * FROM `images` WHERE `img_id` = ".$viewid."");
$rows = mysql_fetch_array($idresult);
?>

<?
session_start();
if ($_POST["action"]=="login") {
$passencode = sha1(md5(md5($_POST["pass"])));
$loginchk = "SELECT *FROM `member`WHERE `username` LIKE '".$_POST["username"]."'";
$passchk = "SELECT *FROM `member`WHERE `password` LIKE '".$passencode."'";
$logi = mysql_query($loginchk);
$passi = mysql_query($passchk);
$resultlogin = mysql_num_rows($logi);
$resultpass = mysql_num_rows($passi);
$fetchuser = mysql_fetch_array($logi);
if ($resultlogin!=1){ echo "<font color=#FFFFFF>ไม่พบ Username ".$_POST["username"]. " ในระบบ</font>";
include "login.php";}
else {if ($passencode!=1) {echo "<font color=#FFFFFF>รหัสผ่านผิด</font>";
include "login.php";}
else 	
if ($_POST["action"]=="login") {
$_SESSION["username"] = $fetchuser["username"];
session_write_close();
include "usermenu.php";
}}}
else { 
include "login.php";
 } ?>

if(get_magic_quotes_gpc()==0)
			{
				$userid=mysql_real_escape_string($_POST['userid']);
				$passwd=mysql_real_escape_string($passwd=md5($_POST['passwd']));
			}
		else
			{
				$userid=$_POST['userid'];
				$passwd=md5($_POST['passwd']);
			}	

<?php
$serverName = "serverName\sqlexpress";
$connectionInfo = array( "Database"=>"dbName", "UID"=>"username", "PWD"=>"password" );
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn === false ) {
     die( print_r( sqlsrv_errors(), true));
}

$sql = "INSERT INTO Table_1 (id, data) VALUES (?, ?)";
$params = array(1, "some data");

$stmt = sqlsrv_query( $conn, $sql, $params);
if( $stmt === false ) {
     die( print_r( sqlsrv_errors(), true));
}
?>