PHP表单中的代码注入

我有一个脚本，它从用户那里收集信息，验证信息，并将其发送到数据库中。

为了避免在每个表单字段上出现任何令人讨厌的问题，我总是运行"htmlspecialchar"answers"addslashes"。

今天我查看了我的错误日志，发现了以下错误：

Unknown: open(/tmp/sess_574af1197644f6c4019d664d71ea5f9e, O_RDWR) failed: Permission denied (13)

这个错误是在处理表单的文件中生成的。显然，有人试图"破解"我的应用程序。我正在努力解决的问题是如何防止这种情况的发生。幸运的是，我的服务器访问级别设置正确，但否则我们会遇到问题。

我需要如何/如何更改我的表单验证，以在前端而不是服务器访问级别捕获此类黑客攻击？

<?php
session_start();
include ($_SERVER['DOCUMENT_ROOT'].'/inc/config.inc.php');
if ($_POST[leverancier]) { $lid = CheckNumericGet($_POST[leverancier]); }
// Afhandelen van de submit
//
if ($_POST[a] == 'ervaring') {
$naam = CheckStringGet($_POST[naam]);
$ervaring = CheckStringGet($_POST[ervaring]);
$email = CheckStringGet($_POST[email]);
$twitter_naam = CheckStringGet($_POST[twitter_naam]);
// Als er een @ in twitternaam zit weghalen
//
if (substr($twitter_naam, 0,1) == '@') {
    $twitter_naam = substr($twitter_naam, 1);
}
include ($_SERVER['DOCUMENT_ROOT'].'/inc/functies_mail.inc.php');
$cont = "yes";
if ($naam == '' | $ervaring == '' |  $email == '' | $rating_foto == '' | $rating_service == '' | $besteld == 0) {
    $cont = "no";
    $msg[][1] = "Helaas, niet alle verplichte velden zijn ingevuld. Probeer het nogmaals.";
}
if (!CheckEmail($email)) {
    $cont = "no";
    $msg[][1] = "Het ingevulde email adres is niet correct";
}
#Als alle velden ingevuld zijn  
if ($cont == 'yes') {
    $server = gethostbyaddr($_SERVER['REMOTE_ADDR']);
    // Ervaring in database plaatsen
    //
    $query = "INSERT INTO 
". $tabel_ervaring ." (lid, naam, email, foto_score, service_score, ervaring, datum, foto, canvas, album, actief, twitter_naam, lev_akkoord)
        VALUES
            ($lid, '$naam', '$email', $rating_foto, $rating_service, '$ervaring', '$datum', '$foto', '$canvas', '$album', '0', '$twitter_naam', '$akkoord')";
    $result = mysql_query($query) or die(mysql_fout($query, $PHP_SELF));
    $ervaring_id = mysql_insert_id();
    $message = "";
    $subject = "Ervaring Fotovergelijk.nl: ";
    mail("xxx@xxx", "$subject", $message, htmlemailheaders($email));
}
$_SESSION[message] = $msg;

}