www.php.net/mysql_real_escape_string
(se usi mysql)