sql injection

I was working on a login script for the admin page of my guestbook and asked some people that i knew to see if they could hack into it. To my surprise they maneged to hack into it in less than half an hour, this got me looking at my code in a new way suddenly i was seeing massive holes in my secrity. So im trying to think of new ways to fill these holes here is one of the ways i came up with.

I dont know if it's been done before or even if it will work but here goes. What if you took harmful characters like ; and - and changed them into harmless ones like ¬ and ^ before inserting them into the database and then on another page when you need it select the data the change it back before printing it.