Validating forms data
One thing that I see right off the bat, is the clean() method.  Why are you escaping things arbitrarily?

public function clean($input) {
    $clean = Array();
    foreach ($input as $field =&gt; $data) {
        $clean[$field] = mysql_real_escape_string($data);
    }
    return $clean;
}


All you're doing is making it harder to trace code, and harder to prove if your code is secure or not.  Not to mention that's a major breach of the Single Responsibility Principle.

It's a huge side-effect and should be removed.

Always escape or quote as close as possible to where you're putting it.