Yeah they can do that also, but as far as i know the mysql_real_escape_string will always escape any input by the user.

__________________
www.jooney.co.uk - the online portfolio