The most useless anti-injection code I've ever seen.

Specific filtering is never as good as simple old addslashes.

Use proper database specific filtering. mysql_real_escape_string, and similar.

Doesn't PHP or PearDB suppot bind variables in queries?

For example...

You don't need to target specific commands if you just ensure that the user can't inject commands, you do this by adding slashes, escaping semicolons, and escaping apostrophes. There is also a huge flaw in your pattern, anyone could inject a null comment '/%%/' and completely bypass your protection.