before inserting into the database, use mysql_real_escape_string(). Below is a modified version of the php code from the link you posted above:
Code:
<?php
if ($_POST['submit']) {
mysql_connect("server","username","password");
mysql_select_db("dbname");
$entrytitle = $_POST['entrytitle'];
$entrytext=$_POST['entrytext'];
$query ="INSERT INTO `weblog` (`entrytitle`,`entrytext`)";
$query.=" VALUES (mysql_real_escape_string($entrytitle),mysql_real_escape_string($entrytext))";
$result=mysql_query($query);
if ($result) echo "<b>Successfully Posted!</b>";
else echo "<b>ERROR: unable to post.</b>";
}
?>
Hope this helps.
Bookmarks