How to sanitize database inputs in C or Objective-C?
The best thing to do is to never, ever, under any circumstances, even in those special cases where you just know it would be easier but really seriously I mean this DO NOT construct SQL statements by concatenating the parameters values into the statement. Use parameter markers and bind the values to the markers. This is the way to avoid SQL injection attacks. Everything else is just so much wasted time and effort because for every N things you think to alter/modify/check for in the parameters typed in by your user somebody is going to think of thing N+1.
Share and enjoy.