[cd34]

another thing to look out for here is the status of either magic_quotes_gpc or magic_quotes_runtime when you are using addslashes.

if _gpc is on, and the variable is posted, it will already have slashes, and if someone knows those settings they could do malicious things.

So, those settings could also add some unexpected behavior when putting ', " and other characters in form fields.