1) mysql_close()
http://www.php.net/manual/en/function.mysql-close.php
Usually not needed, as it auto-closes at the end of a php execution.
2) addslashes()
http://www.php.net/manual/en/function.addslashes.php
Do this to any variable you wish to put into a sql query, like so:
$name_q = addslashes($name);
$sql = "INSERT INTO table SET name='$name_q'";
OR
$sql = "INSERT INTO table SET name='".addslashes($name)."'";
Also keep in mind, if you have magic_quotes on, incoming vars will already have "addslashes" done to them. But if you have magic_quotes off in your php.ini, then you should do "addslashes" to pretty much anything you put into a sql query string.
Personally I think its far easier to deal with slashes when you NEED to deal with them (sql queries) than to have that crap magic_quotes turned on to where you then have to use MANY more "stripslashes()" functions instead.
PS: to the nit picky SOBs who might nit pick my post... I said "pretty much" anything... I didnt say "EVERYTHING"... so go jump in a frelling lake.
