You can also, if you know the input can only be alphanumeric, is to build a function (which could be used for other things as well), which replaces all characters except any alphanumeric ones. However, out of addslashes() and mysql_real_escape_string(), the latter is definitely the best choice.