Application vulnerable to SQL injection attacks

[Markkaz]

Not all parameters to queries are escaped and the escaping mechanism used is addslashes.
The documentation of addslashes states:

The addslashes() is sometimes incorrectly used to try to prevent SQL Injection. Instead, database-specific escaping functions and/or prepared statements should be used. 

The function mysql_real_escape_string should be used instead.