note 6151 deleted from MySQL functions by danbeck

Using MySQL with PHP3.. I have an HTML registration form that a user fills out. When submitted, their info is added to the MySQL database. However, it fails to insert anything if the user types a single quote (') in any of the text fields on the HTML form. (For example, if I put my company name as "Dave's House of Hoes"). I think this is happening because the SQL that it writes is "INSERT Registrants VALUES('$CompanyName', '$UserName', etc)".. so when $CompanyName and $UserName are replaced, the SQL query is tainted with more single-quotes than it wants.. do I simply filter the single-quotes from input, or are there other characters that might possibly screw me up? (Like or " or |?) Is there a pre-defined function to strip or convert all the evil characters to SQL-friendly code?