verificar valor antes de montar a query

login.php

@@ -169,6 +169,8 @@ function DispLogin($smarty) {
 }
 
 function countTentativas($dbcon, $login, $tentativaErro) {
+    $login = addslashes($login);
+
     $query = "SELECT COUNT(*) AS tentativas FROM pbx_controle_acesso WHERE acs_login = '$login' AND acs_data_ini::DATE = 'now' AND acs_erro = 1;";
     $result = pg_query($dbcon, $query);
     $res = pg_fetch_assoc($result);