added HTML stripping and mySQL quoting for user supplied strings