function sql_inj_str($str)
{
        if(get_magic_quotes_gpc())
        {
                $str=stripslashes($str);
        }
        return mysql_real_escape_string($str);
}

function sql_inj_num($str)
{
        $chars=preg_replace("[\D]","",$str);
        if(is_numeric($chars))
        {
                return $chars;
        }
        else
        {
                return false;
        }
}

$username=sql_inj_str($username);
$password=sql_inj_str($password);

$gallery=sql_inj_num($_GET[gallery]);