Simply wrap it around $name = $_REQUEST['name'];
$name = mysql_real_escape_string($_REQUEST['name']);
Remember that mysql_real_escape_string requires a database connection. If you read up on mysql_real_escape_string on php.net I believe there's a good function called quote_smart() in the comment section that takes into consideration a few other things aswell, I would go look it up and implement that if I were you.
require_once '../connect.php'; <--- This is the file you would want outside of the WWW directory, the file that inserts the data into the DB can be in the www folder, that's no problem.
In your final code, don't include mysql_error() in any errors, that makes it so much easier for anyone to get access if you have any security flaws. For debugging it's cool though, just remember to remove it.
As for 4 chars minimum, if you don't want to reload the page, you can use Javascript to check the input TOGETHER with a php check, or you can just do a PHP check.
Javascript check can't be trusted, but it will tell the user instantly if it's 4 chars or not in the field. You'll have to look up some javascript code if you want to implement that.
For php it's simple...
if (strlen($_GET['name']) > 4)
$name = mysql_real_escape_string($_GET['name']);
else
//some error
I would use $POST, $GET and $COOKIE instead of $REQUEST because it makes it easier to read the code, not a requirement, but a preference.
To check that it does not include % ; : ' . , ` you can do this:
$myBadCharArray = array("%", ";", ":", "'", ".", ",", "`");
if (strlen($_GET['name']) > 4){
$name = str_replace($myBadCharArray, "", $_GET['name']); //removes any occurance of the bad chars in the variable
$name = mysql_real_escape_string($name);
}else{
//some error
}
Hope this helps
