Re: basic user/input form questions... more validation!

bruce wrote:

further investigation seems to imply that 'strings' that are to be inserted into the mysql db should be 'backslashed' for the chars > \x00, \n, \r, \,'," and \x1a. this implies that i can have a simple function to accomplish this. the mysql_real_escape_string function requires a db connection and the app might not have opened up a connection to the db at this point in the code.. (or i could rewrite the code!!)

That would indicate that your code needs rewriting. You should use mysql_real_escape_string as it takes into account the character set in use on your MySQL connection (which is why it needs a DB connection). -- Jasper Bryant-Greene Freelance web developer http://jasper.bryant-greene.name/