also ungefaehr so:
$sql = sprintf("INSERT INTO user (1, 2) VALUES",
mysql_real_escape_string($_SESSION['1']),
mysql_real_escape_string($_SESSION['2']));
also ungefaehr so:
$sql = sprintf("INSERT INTO user (1, 2) VALUES",
mysql_real_escape_string($_SESSION['1']),
mysql_real_escape_string($_SESSION['2']));