Protecting my script from spanners ???

Question

Protecting my script from spammers ????
I am a newbie.  I am using DW CS5.  I have a members register form and a database for the users set up.  I use the DW service behavior of “recordset” and “insert record” to add the new users from the form to the database.  All works well except for one (?) problem. 
A book I was reading suggested that I should test to make sure that no illegal characters are inserted in the user submitted values by using the lines of code below to strip slashes from the input before updating the database.  I would have thought the DW did this as part of their standard code.  But when I test DW by adding some illegal characters in one of my values, the illegal characters still show up in my data when I view the table using phpMyAdmin.
I have tried to add this code (with and without some modifications) to the “standard” DW code (this code is located at the end of this posting) generated by DW without any success.  DW gives me an error if I make ANY change to the “standard” DW code.
My questions:
  1.   Does the “htmlentities” function and the “get_magic_quotes_gpc() “  in the DW code do the same or similarly job of stripping illegal characters from the fields?  If so, why is the get_magic_quotes_gpc only applied for less than PHP- 6 ?
  2.   If yes, why do I still see the slashes in my data when I view it with phpMyAdmin?
  3.   What is the best way to protecting my script from spammers inserting illegal characters in my scrip using the tools that comes with DW CS5?  Or should I use some other method?
…………. strip some slashes code to add to DW code …………..
// Define post fields into simple variables
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$email_address = $_POST['email_address'];
$username = $_POST['username'];
$info = $_POST['info'];
/* Let's strip some slashes in case the user entered
any escaped characters. */
$first_name = stripslashes($first_name);
$last_name = stripslashes($last_name);
$email_address = stripslashes($email_address);
$username = stripslashes($username);
$info = stripslashes($info);
…………. DW standard insert code…………….
<?php require_once('../Connections/ndc_olcs.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  return $theValue;
$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "frJoin")) {
  $insertSQL = sprintf("INSERT INTO users (first_name, last_name, email_address, username, info, user_level, signup_date) VALUES (%s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['first_name'], "text"),
                       GetSQLValueString($_POST['last_name'], "text"),
                       GetSQLValueString($_POST['email_address'], "text"),
                       GetSQLValueString($_POST['username'], "text"),
                       GetSQLValueString($_POST['info'], "text"),
                       GetSQLValueString($_POST['user_level'], "text"),
                       GetSQLValueString($_POST['signup_date'], "date"));
  mysql_select_db($database_ndc_olcs, $ndc_olcs);
  $Result1 = mysql_query($insertSQL, $ndc_olcs) or die(mysql_error());
  $insertGoTo = "../user_list.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  header(sprintf("Location: %s", $insertGoTo));
mysql_select_db($database_ndc_olcs, $ndc_olcs);
$query_rsJoin = "SELECT * FROM users";
$rsJoin = mysql_query($query_rsJoin, $ndc_olcs) or die(mysql_error());
$row_rsJoin = mysql_fetch_assoc($rsJoin);
$totalRows_rsJoin = mysql_num_rows($rsJoin);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/Templates/master.dwt" codeOutsideHTMLIsLocked="false" -->
<head>
The form’s HTML code continues from here……
Thank you.

Answer 1

Relying on an editor like DW to protect your DB or spam attacks is not a good idea.  Spammers and those that wish to attack your database work at it as a full time occupation, so when some new protective script comes along, they work on overcoming it.
"" If so, why is the get_magic_quotes_gpc only applied for less than PHP- 6 ?""
Magic quotes are deprecated and will not be in PHP6.
I would suggest using this for your email variable:
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
I would look up "re-captcha" and "honey pot' for some additional security.
Here is something I put together some time back, it is not complete or comprehensive and more research should be done, but it might help you to understand a little better.
http://www.paulgdesigns.com/secure.php
HTH
Gary