Using SQL Injection Prevention to Remove Commas

I need to ensure the user does not insert any commas into the Order and OrderDetails tables in the MySQL database. I was thinking the easiest option might be to add some code to the code that eCart uses to prevent SQL Injections. I am using DW CS5.5, eCart 5.0.3 on OSX Lion 10.7.2

I am fairly new to using SQL. Any help will be greatly appreciated.

the orders detail table will only store the information from the cart, no user entered information.

the orders table is the only one that will store user entered information.

on the confirm page, add the following code at line 1 to strip any commas from the info posted from the checkout form:

<?php

if($_SERVER['REQUEST_METHOD'] == "POST") {

    foreach($_POST as $k => $v) {

        $_POST[$k] = str_replace(",", "", $v);

    }

}

?>

Thanks Jason! That's exactly what I was looking for.

For a site of mine I'm getting the following error:

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' convert#int,convert#varchar,0x7b5d## \' AND ID= -1)' at line 1"

This happens when I use the following URL:

page.php?ID='+convert(int,convert(varchar,0x7b5d))+'

This shows that Im prone to SQL Injection. How do I prevent this?

send a copy of the page please