$username=$_POST['username']; $username = htmlspecialchars($username); $username = mysql_real_escape_string($username);