mysql_real_escape_string() _will_ protect you from code injection. - http://php.net/mysql_real_escape_string http://php.net/mysql_real_escape_string "Note: If

mysql_real_escape_string() _will_ protect you from code injection. - http://php.net/mysql_real_escape_string http://php.net/mysql_real_escape_string "Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks." - http://www.php.net/manual/en/security.database.sql-injection.php http://www.php.net/manual/en/security.database.sql-injection... - http://www.metatitan.com/php/16/protecting-your-phpmysql-queries-from-sql-injection.html http://www.metatitan.com/php/16/protecting-your-phpmysql-que... - http://en.wikibooks.org/wiki/Programming:PHP:SQL_Injection http://en.wikibooks.org/wiki/Programming:PHP:SQL_Injection