note 33106 added to function.html-entity-decode

not sure about this, but I think that this'll work: $sql_safe = addslashes(html_entity_decode(stripslashes($_POST['data1']))) this is for the case of, for example, you want a dropdown-menu selection (so need htmlspecialchars()), but of course you dont trust people to actually use the form when they could just POST you whatever they want using telnet ---- Manual Page -- http://www.php.net/manual/en/function.html-entity-decode.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+33106 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+33106&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+33106&report=yes