note 40584 added to function.mysql-real-escape-string

If you are submitting directly from a form or reading from a cookie then its usually easier (if you are the admin of your server) to set make php do it for you by configuring magic_quotes_gpc. http://us3.php.net/manual/en/ref.info.php#ini.magic-quotes-gpc or you can do something a bit smarter like ; function cleanField($field){ if(get_magic_quotes_gpc()==0){ $field=mysql_real_escape_string($field); } return $field; } ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+40584 Delete -- http://master.php.net/manage/user-notes.php?action=delete+40584&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+40584&report=yes Search -- http://master.php.net/manage/user-notes.php