Text input to database questions

[Karma]

Hi all,

A couple of questions...

1. I have a script that allows visitors to enter text in to a form, which is then sent to a database for me to check over. However, if a visitor enter something like an apostrophe in to an input field, when the form is processed, they get an error. (You have an error in your SQL syntax blah blah). How do I stop this from happening? At the moment, I am only using...

$field = stripslashes($form_input);

2. If I have a text area input in my form, the formatting is lost when the user clicks submit. Is there an easy way to keep the formatting? (line breaks etc)

Many thanks

[supermanjnk]

$field = htmlspecialchars($form_input, ENT_QUOTES);

[RonPK]

1. $field = mysql_real_escape_string($form_input);

2. you mean when you display the text but not in a textarea? Try nl2br().