http://php.developpez.com/faq/?page=mysql#mysql-escape

$pdo = new PDO('mysql:dbname=NOM_DE_LA_DB;host=localhost', 'username', 'password');
$pdo->prepare('delete from flatforswap_adherent where id_adh = :id');
$pdo->execute(array(
   'id' => $_GET['id'],
));

/ Protège la variable avant l'insertion

function quote_smart($value)
{
// Stripslashes si nécessaire
        if (get_magic_quotes_gpc())
        {
                $value = stripslashes_deep($value);
        }

// Protection si ce n'est pas un entier
        if (!is_int($value))
        {
                $value = "'" . mysql_real_escape_string($value) . "'";
        }
return $value;
}

voici un exemple de mon code, penses-tu qu'il est protégé des injection mysql ?

// Protège la variable avant l'insertion

function quote_smart($value)
{
// Stripslashes si nécessaire
	if (get_magic_quotes_gpc())
	{
		$value = stripslashes_deep($value);
	}

// Protection si ce n'est pas un entier
	if (!is_int($value))
	{
		$value = "'" . mysql_real_escape_string($value) . "'";
	}
return $value;
}

$sqly = sprintf("delete from flatforswap_adherent where id_adh=%s", quote_smart($_GET['id']));
$reqy = mysql_query($sqly) or die('Erreur SQL : <br />'.$sqly);

$sql_des = sprintf("delete from flatforswap_destination where id_adh=%s", quote_smart($_GET['id']));
$req_des = mysql_query($sql_des) or die('Erreur SQL : <br />'.$sql_des);

$sql_log = sprintf("delete from flatforswap_logement where id_adh=%s", quote_smart($_GET['id']));
$req_log = mysql_query($sql_log) or die('Erreur SQL : <br />'.$sql_log);