Want to Hire SQL Expert to Protect Against SQL Injections

Good share +1

Your the pro. I only know fundamental .php so where do I get the code and where
do I install it? I will be reading the PDO Manual soon.

The reason I wanted to hire someone is that I do not have the time to do all this
well with knowing I can verify what I am doing is correct. I would probably need at least 10 hours just to read the manual twice. I do not have that time because I am in the middle of attempting to clone an old hard drive using TrueImage 14 to another drive that needs to be installed in the laptop before the imaging/cloning can take place. This is a new development with Acronis and I guess is to prevent users from running a cloning factory. I certainly did not plan to do that but what you need to do now is to have the source drive as an external drive on a docking station and the destination drive installed in the laptop. Hope that helps someone.

All 3 sites need to be redesigned because the people who designed them were idiots ,i.e.
on one site,when I pay people it never records it in payments,so I can continue to pay people but no one will know;
second, I need to have the whole format of the 2 frontpages redesigned to reflect that there are good advertising opportunities inside and to highlight packages;
third, on one site when I go to pay someone, it says I need to pay them $1 more than I actually owe them,so if I owe them $.12, it says I need to pay them $1.12.

There is an administrative forum website called Aurora Forum and it is run by the designer of these idiot sites so can you understand why I wanted outside assistance.

No, I have no forum pages on these sites but I had to delete 2 forums because they had been so corrupted.

Use PDO or MySQLi (notice the i). Plain mysql functions are deprecated. But here's a quick sample code of how to solve your SQL injection problem: (Apparently I can't post PHP script in here or [CODE] so you get regular text)
--
// Get the username from a POST login script. Escape it.
$username = mysqli_real_escape_string($con, $_POST['username']);
// The above will turn "That's a great idea" into "That\'s a great idea" so SQL injections aren't possible (but not special characters like the tick ` as well)

// Query the database.
// All values need to be stored as escaped content. That means extra slashes.
$query = mysqli_query($con, "SELECT firstname, lastname, status FROM table WHERE column2='$username' LIMIT 1") or die(mysqli_error($con));

// Pull information from the databse
// Lets assume one row was found
$user = mysqli_fetch_array($query); // this creates an array for the user information
// Now we need to unescape it

// Below will return "That's a great idea said {insert name}"
echo stripslashes($user['status']) . " said " . stripslashes($user['firstname']);
--
One more thing you can do. The username that connects to your database, remove unused controls. If you never drop tables, remove the drop control so IF someone SQL Injected your site, they cannot drop your tables.