#hack to fix someone else's #PHP #fail foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); }