here are some php function that can prevent hacks and attacks.

strip_tags() removes html and php tags from string. should be immediately called on data input and before any data processing functions.

nl2br() converts newlines to <br />. run strip_tags before calling this function or the <br /> will be stripped.

htmlspecialchars() convert special chars to html entities. & (ampesand) becomes &amp;, < becomes &lt; etc.