Avoid SQL Injection - with PHP and Mysql

Question

When I try to log in to the administration page of the site with ' OR 1=1 -- in the login and password it allows access!

I’m trying to use the next function, but I still have access without permission:

function protect( &$str ) {
        if( !is_array( $str ) ) {                      
                $str = preg_replace( '/(from|select|insert|delete|where|drop|union|order|update|database)/i', '', $str );
                $str = preg_replace( '/(&lt;|<)?script(\/?(&gt;|>(.*))?)/i', '', $str );
                $tbl = get_html_translation_table( HTML_ENTITIES );
                $tbl = array_flip( $tbl );
                $str = addslashes( $str );
                $str = strip_tags( $str );
                return strtr( $str, $tbl );
        } else {
                return array_filter( $str, "protect" );
        } }

On the login check screen, you have the following code:

session_start();
$login = protect($_SESSION['login']));
$senha = protect($_SESSION['senha']));

Could someone give me a hand? How to block this kind of access?