title: quote marks in sql causing problems
body: <p>I have a simple html input textbox in a very simple form. the information form this form is transmitted to a mysql database with an sql string.</p>
  
  <p>Everything works slick, except when someone types " or '. I don't want to limit the users as to what they can type.</p>
  
  <p>Should I do a find and replace to the string before I run the query against the database?</p>
  
  <p>Is there a simple way?</p>
  
  <p>here's some code:</p>
  
  <pre><code>&lt;?php
  session_start();
  if (empty($_SESSION['user']) &amp;&amp; empty($_REQUEST['form'])) //check this code!!1
  {
      exit;
  }
  if (isset($_REQUEST['Submit']))
  {
      //echo "Let's process this form!";
      include "config.php";
      include "mail.php";
      if ($_REQUEST['form'] == "profile")
      {//public profile
          //print_r($_REQUEST);
          //"UPDATE `tims`.`pending_profile` SET `nickname` = 'I Don''t Have One' WHERE `pending_profile`.`id` = 1;";
          $sql = "INSERT INTO `tims`.`pending_profile`"
                  . "(`id`, `nickname`, `location`, `role`, `yog`, `interests`, `favMoment`, `gainThisYr`, `futurePlans`, `bio`) \n"
                  . "VALUES ('" . $_SESSION['id'] . "', '" . $_REQUEST['nickname'] . "', '" . $_REQUEST['town'] . "', '" . $_REQUEST['role'] . "', '" . $_REQUEST['yog'] . "', '" . $_REQUEST['interests'] . "', '" . $_REQUEST['fav_moment'] . "', '" . $_REQUEST['gain'] . "', '" . $_REQUEST['future'] . "', '" . $_REQUEST['bio'] . "')\n"
                  . "ON DUPLICATE KEY UPDATE nickname ='" . $_REQUEST['nickname'] . "', location='" . $_REQUEST['town'] . "', role= '" . $_REQUEST['role'] . "', yog='" . $_REQUEST['yog'] . "', interests='" . $_REQUEST['interests'] . "', favMoment='" . $_REQUEST['fav_moment'] . "', gainThisYr='" . $_REQUEST['gain'] . "', futurePlans='" .       $_REQUEST['future'] . "', bio='" . $_REQUEST['bio'] . "'\n";  
          $qry = mysql_query($sql) or die(mysql_error());
  
  //@todo overlay this
  //http://flowplayer.org/tools/overlay/index.html
          //send mail to moderators
          include "vars.php";
          $to = $captMail;
          $prof = implode("\n", $_REQUEST);
          $subject = "Moderation Needed";
          $body = $_SESSION['fullname'] . " Has just changed their public profile.\n" .
                  "Please login here to moderate their changes:\n" .
                  //"http://team2648.com/OPIS/login.php?page=manage".
                  "http://www." . $sysurl . "/login.php?page=manage\n" .
                  "Best,\n" .
                  "Blake\n\n\n" .
                  "Click here to accept the profile bleow\n\n" .
                  "http://www." . $sysurl . "/login.php?page=manage&amp;acceptID=".$_SESSION['id']."\n" .
                  $prof;
          mailer($to, $subject, $body);
          $to = $mentorMail;
          mailer($to, $subject, $body);
  
          echo "&lt;link href=\"../css/styling.css\" rel=\"stylesheet\" type=\"text/css\" media=\"screen\" /&gt;";
          echo "&lt;div class =\"widget\" style=\"width:350px\"&gt;";
          echo "Your changes have been saved, they will not go live until reviewed by a moderator";
          echo "&lt;br&gt;";
          echo "&lt;a href=\"../\"&gt;Click here to continue&lt;/a&gt;";
          echo "&lt;/div&gt;";
      }
      exit;
  }
  $sql = "SELECT * FROM `pending_profile` WHERE id ='" . $_SESSION['id'] . "'";
  $qry = mysql_query($sql) or die(mysql_error());
  $row = mysql_fetch_assoc($qry);
  ?&gt;
  &lt;!--&lt;h3&gt;Use this page to manage your profile information&lt;/h3&gt;--&gt;
  &lt;h4&gt;Public Profile&lt;/h4&gt;
  &lt;strong&gt;NOTE:&lt;/strong&gt; Fields filled with [NONE] will not show on the website.
  &lt;br /&gt;
  &lt;form id="profile" name="profile" method="get" action="lib/preview.php"&gt;
      &lt;input type="hidden" value="profile" name="form"&gt;
      &lt;input type="hidden" value="&lt;?php echo $_SESSION['id']; ?&gt;" name="id"&gt;
      &lt;table&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="myname"&gt;Hello, My name is:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" readonly="readonly" name="myname" value="&lt;?php echo $_SESSION['firstname']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="nickname"&gt;But I like to be called:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="nickname" value="&lt;?php echo $row['nickname']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="town"&gt;I live in:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="town" value="&lt;?php echo $row['location']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="role"&gt;My role on the team is:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="role" value="&lt;?php echo $row['role']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="yog"&gt;I will graduate High School in:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="yog" value="&lt;?php echo $row['yog']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="interests"&gt;Some of my interests are:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="interests" value="&lt;?php echo $row['interests']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="fav_moment"&gt;One of my favorite team moments:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="fav_moment" value="&lt;?php echo $row['favMoment']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="gain"&gt;I would like to gain the following this year:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="gain" value="&lt;?php echo $row['gainThisYr']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="future"&gt;My future plans include:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;input type="text" name="future" value="&lt;?php echo $row['futurePlans']; ?&gt;"/&gt;&lt;td&gt;
          &lt;/tr&gt;
          &lt;tr&gt;
              &lt;td&gt;&lt;label for="bio"&gt;My Bio:&lt;/label&gt;&lt;td&gt;
              &lt;td&gt;&lt;textarea name="bio" &gt;&lt;?php echo $row['bio']; ?&gt;&lt;/textarea&gt;&lt;td&gt;
          &lt;/tr&gt;
      &lt;/table&gt;
      * All fields are required.
  &lt;?php
  include "disclaimer.php";
  // @todo add js validation of all fields filled in
  ?&gt;
      &lt;br&gt;&lt;input type="submit" name="Submit" value=" I Agree, Preview "/&gt;
  
  &lt;/form&gt;
  </code></pre>