That's exactly what the page says NOT to do - attempt to escape input data. Instead, use MySQLi_STMT http://de2.php.net/manual/en/class.mysqli-stmt.php