Re: SQL Injections
yeah, always validate your input. If using mysql use mysql_real_escape_string to strip '`; etc. If not using mysql use addslashes.
trim() any spaces from strings, check the legnth of a string strlength i think, and use preg_match to make sure only nice chars allowed.