mysql_real_escape_string()
string mysql_real_escape_string(string[,link])
This function returns the string given with special
characters preceded by backslashes so that they are protected from
being interpreted by the SQL interpreter. Use this in conjunction with
the mysql_query() function to make SQL
statements safe. This function does not escape % or
_ characters, but it does take into account the character set of the
connection. A different connection may be specified as the second
argument to the function. This
function is similar to mysql_escape_string(),
but it escapes a string based on the character set for the current
connection.