On: Prevention of SQL injection in PHP

[duskwuff]

While we're at it: it also fails to understand the difference between addslashes() and mysql_escape_string(). (It's not just a matter of whether you're assigning the result to a variable or not!)

[mildweed → duskwuff]

While you're still at it: get rid of the quotes entirely, just htmlentities( ) where appropriate.