sql injection vulnerability

[robert_gsfame]

i just want to ask this simple question

 

let say i have this basic query

 

$place=$_GET['place'];

mysql_query("SELECT * FROM table WHERE place='$place'");

 

this is a nice target for sql injection..

 

but what if i replace the whole special characters that could be added

 

$replacethis=array("-","`");

$withthis=array("","");

$place=str_replace($replacethis,$withthis,$_GET['place']);

mysql_query("SELECT * FROM table WHERE place='$place'");

 

Are they still able to do the basic sql injection by trying to get the error by adding special character although i didn't use mysql_real_escape_string() ??

 

then what if i protect the file by changing the setting of the permission to either 644 or 755?

thanks in advance

[kenrbnsn]

Why don't you want to use mysql_real_escape_string?

 

Ken

[robert_gsfame]

am just asking for new option 

 

but although i can prevent this one, there is a lot of hacking method will be used..