<?
foreach($_GET as $get => $value)
{
	$_GET[$get] = htmlspecialchars(mysql_escape_string($value));
}
foreach($_POST as $post => $value)
{
	$_POST[$post] = htmlspecialchars(mysql_escape_string($value));
}
?>