cleaning user input from forms

Howdy Y'all: I have functions that validate all user input submitted from forms. One of the steps is making sure no nasty characters make their way into my code or database. This step is performed through the following command: $Out = substr( ereg_replace("[^A-Za-z0-9._@-]", "", $In), 0, 500 ); What I'm wondering about... are there characters, or combinations thereof, that would trip even this up? If so, what would be a better way to perform this needed task. I poked around the mailing list archives for answers but didn't find anything on the mark. Thanks, --Dan -- T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y More than just answers. Solutions. (SM) http://www.analysisandsolutions.com/ 4015 7 Av #4, Brooklyn NY 11232 v: 718-854-0335 f: 718-854-0409