Yeah, all you gotta do is stop SQL injection.....
(What you could do, is use eregi() or something to remove words like UPDATE, DELETE, INSERT, DROP, CREATE, etc.
Btw I consider OP2 "hacking" more "cracking" and "reversing" than hacking... Those words define it better.