Preventing MySQL Injections while Keeping Apostrophes?

[lpxxfaintxx]

So I created a simple function that strips all posted data from potential malicious data, but I realized a big flaw. All the apostrophes were stripped, resulting in awkward looking text when saved.

 

Is there any better way of doing this? How would I output it?

 

function form($data) { 
   global $db_connect;
   $data = ereg_replace("[\'\")(;|`,<>]", "", $data);
   $data = mysql_real_escape_string(trim($data), $db_connect);
   return stripslashes($data);
}

[GingerRobot]

If magic_quotes are turned off, just use mysql_real_escape_string() - there's no need to do anything further. If magic_quotes are turned on, you'll want to stripslahes() first.