รบกวนขอวีธีป้องกัน.SQL injectionหน่อยนะครับ ขอยคุณคับ

$ips = getenv(REMOTE_ADDR);
date_default_timezone_set('Asia/Bangkok');
$Todays = date('d-m-Y H:i:s',strtotime("+6 hours"));
$Today = date("d-m-Y H:i:s");

	session_start();
	include("../config.inc.php");
	$user = $_REQUEST['User'];
	$pass = $_REQUEST['Pass'];
	$strSQL = "SELECT * FROM member WHERE User = '".$user."' and Password = '".$pass."'";
	$objQuery = mysql_query($strSQL);
	$objResult = mysql_fetch_array($objQuery);
	if($user == "")
	{
			echo "NoUser";
			exit();
	}
	if($pass == "")
	{
			echo "NoPass";
			exit();
	}
	if(!$objResult)
	{
			echo "Error";
			exit();
	}
	else
	{
    $_SESSION["id"] = $objResult["id"];
	session_write_close();
	$strSQL2 = "SELECT * FROM member WHERE id = '".$_SESSION['id']."' ";
	$objQuery2 = mysql_query($strSQL2);
	$objResult2 = mysql_fetch_array($objQuery2);		
	if($objResult2["PROPBTH01"] == "0")
	{
			echo "NoData";
			exit();
	}
    if($objResult2["hwid"] != $objResult2["hwid"]) 
    {
    echo "hwidNohwid";
    exit();
    }
	if($objResult2["hwid"] == "0")
	{
			echo "Nohwid";
			exit();
	}
	else
	{
	echo "Ok";
	exit();
	}
	//ทำเพิ่มเพื่อให้ข้อมูลอัพเดทเพิ่ม
	$strSQL2 = "SELECT * FROM member WHERE id = '".$_SESSION['id']."' ";
	$objQuery2 = mysql_query($strSQL2);
	$objResult2 = mysql_fetch_array($objQuery2);
	}
	mysql_close();