Well that and if they are coming directly from the form she needs to protect against sql injection too, if that is not already happening.
I hate dealing with escapes, so I write my code to deal with them as little as possible..lol. It is the one thing about php that I don't like compared to the other languages I deal with.
My standard way of dealing with this shit if I have to is..
1. turn on mysql at the beginning of the script.
2. run all input vars through mysql_real_escape_string
3. run all input vars through addslashes
4. Stick them into the database
so.. like this
mysql_pconnect($mysql_host,$mysql_user,$mysql_ass) ;
mql_select_db($mysql_db);
$input_var=addslashes(mysql_real_escape_string($_P OST['input_var']));
$result=mysql_query("insert into database.tablename(field2insertinto)values(" . $input_var . ")");
But if the only thing I am dealing with is a single quote prob because it is a protected form or because I am doing an update routine that is not form fed then I just used the replace a single quote with 2 single quotes like I said orignally
