Проверка на sql injection

<? include('checkcookie.php'); ?>
<h3>Блокировка доступа к сайту</h3>
<br>

<?
if($_POST["action"]!="")
{
$action=$_POST["action"];

if($action=="addip")
{
$ip=$_POST["ip"];
mysql_query("insert into tb_accessblock (ip) values ('$ip')");
echo "<font color=#00dd00>Добавлено</font>";
}
if($action=="addwmid")
{
$wmid=$_POST["wmid"];
mysql_query("insert into tb_accessblock (wmid) values ('$wmid')");
echo "<font color=#00dd00>Добавлено</font>";
}
if($action=="delete")
{
$id=$_POST["id"];
mysql_query("delete from tb_accessblock where id='$id'");
echo "<font color=#dd0000>Удалено</font>";
}
}
?>

<table width="100%">
<tr>
<th>Добавить IP-адрес или маску в черный список</th>
<th>Добавить WMID в черный список</th>
</tr>
<tr>
<td valign=top width="50%" align=center>

<form action="" method=post>
<b>Введите IP-адрес или маску:</b><br>
<input type=text value="" size=30 maxlength=15 name="ip"><br>
<input type=hidden value="addip" name="action">
<input type="submit" value="Добавить">
</form>

</td><td valign=top width="50%" align=center>

<form action="" method=post>
<b>Введите WMID:</b><br>
<input type=text value="" size=30 maxlength=12 name="wmid"><br>
<input type=hidden value="addwmid" name="action">
<input type="submit" value="Добавить">
</form>

</td></tr>
</table>

<table width="100%">
<tr>
<th>Список заблокированных IP-адресов</th>
<th>Список заблокированных WMID</th>
</tr>
<tr>
<td valign=top width="50%" align=center>
<table style="border:0px">
<?
$res=mysql_query("select * from tb_accessblock where ip!='' order by id asc");
while($row=mysql_fetch_array($res))
{
echo "<tr><td style="border:0px">".$row["ip"]."</td>";
?>
<td style="border:0px">
<form action="" method=post>
<input type="hidden" value="<?=$row["id"]?>" name="id">
<input type="hidden" value="delete" name="action">
<input type="submit" value="Удалить">
</form>
</td></tr>
<?
}
?>
</table>
</td><td valign=top width="50%" align=center>
<table style="border:0px">
<?
$res=mysql_query("select * from tb_accessblock where wmid!='' order by id asc");
while($row=mysql_fetch_array($res))
{
echo "<tr><td style="border:0px">".$row["wmid"]."</td>";
?>
<td style="border:0px">
<form action="" method=post>
<input type="hidden" value="<?=$row["id"]?>" name="id">
<input type="hidden" value="delete" name="action">
<input type="submit" value="Удалить">
</form>
</td></tr>
<?
}
?>
</table>
</td></tr>
</table>