Something

  // if no magicquotes, escape input  if (!get_magic_quotes_gpc()) {  	foreach($_POST as $key => $value) { 		$_POST[$key] = mysql_real_escape_string($value); 	}	foreach($_GET as $key => $value) {	  $_GET[$key] = mysql_real_escape_string($value); 	}  }