$user= stripslashes($user);$pass= stripslashes($pass);$user= mysql_real_escape_string($user);$pass= mysql_real_escape_string($pass);