Bere usr z URL adresy
PHP kod:

$usr=$_GET["usr"];
.
.
.
$usr = check($usr);
$res=mysql_query("SELECT `history` FROM `player` WHERE `name`= $usr LIMIT 1",$mysql);

Deklarace check():

function check($value) {

if (get_magic_quotes_gpc() )
   $value = stripslashes($value);

if (!is_numeric($value) )
   $value = "'".mysql_real_escape_string($value)."'";

return $value;
} 

Výpis z sqli scanneru:
Keyword Found: [hr
Injection type is String (')
DB Server: MySQL >=5
Selected Column Count is 13
Valid String Column is 1
Current DB: XXX

Nadpis je snad jasný.
Pokud byste chtěli celý kód napište, děkuji za každou radu :)