Special HTML chars rocking me!

[YamahaR1]

Here is what I have.

$body=$_POST['body'];
$body = str_replace ( '\"', '"', $body );

And its NOT removing the quotes! The user is placing QUOTES inside the body text, and its blowing away my MySQL string, by putting quotes in there.

I tried htmlspecialchars, ENT_QUOTES, and htmlentities, and then doing it manually like above.

When I display the result string? Its the SAME. Quotes are still there, and still no query. Why?

[jorj]

addslashes() is what you want. htmlspecial function is for avoiding tags into the output text.