$user= stripslashes($user); $pass= stripslashes($pass); $user= mysql_real_escape_string($user); $pass= mysql_real_escape_string($pass);