Example: That’s is getting written as That\’s
thats an age old problem, there is a function that does that for you, otherwise if you are a good programmer you can do this yourself by using str_replace()
It’s also advised that you do a server-side sanity check on anything coming through the DMZ. This usually means bounds-checking variables for the most part.