Thanks for the input.

Well, Over the past few hours, i've gotten my self a log-in-able blog, that shows the last three records!

Not majorly secure, I know, but it's good enough for tonight.

One question - When I enter in a review, if I type in an apastrophe, it complains about syntax error - like it's parsing the stuff I enter as php or something?

Any idea what sort of stuff you can do to stop that?

when you convert you $_POST to a regular variable, addslashes on it...ie

$text=addslashes($_POST[text]);

you're running into those hacks we're talking about.

If you have the ability to edit your php.ini. you should turn magic_quotes on.

hmm, I dunno if i do have permision to edit the server php.ini - but I can get them to do it for me.

Satis: Can I add more than one thing to the POST part? Because I already have htmlentities there. (hehe, tities)

if you're asking if you can run more than one function on the $_POST, yes, you can run as many as you want.

ie:

$text = addslashes(htmlentities($_POST[text]));

you can wrap as many together as you want. I think my record is 4 or 5. Pig probably has twice as many.

The only time I every wrapped more than 4 or 5 function calls like that, was because I didn't know what I was doing. I think I was using str_replace, and didn't realize you could use an array as the search parameter.

If you can get magic_quotes turned on, you should. Just realize that using add_slashes is redundant, and you should not do both. Just one or the other.

I often use a script I wrote called purge_text() that I feed all user input through. It checks if magic_quotes is on, and adds them manually if it is not. It also does strip_tags, htmlspecialchars, trim, and maybe another function or two.

thanks guys