MySQL_Prep

mysql_prep.php

<?php
//use this function to clean values going into mysql
function mysql_prep($value)
{
	$magic_quotes_active = get_magic_quotes_gpc();//boolean - true if the quotes thing is turned on
	$new_enough_php = function_exists("mysql_real_escape_string");//boolean - true if the function exists (php 4.3 or higher)
		
	if($new_enough_php)
	{
		if($magic_quotes_active)
		{
			$value = stripslashes($value);//if its a new version of php but has the quotes thing running, then strip the slashes it puts in
		}
		$value = mysql_real_escape_string($value);//if its a new version use the function to deal with characters
	}
	else
		if(!$magic_quotes_active)//If its an old version, and the magic quotes are off use the addslashes function
		{
			$value = addslashes($value);
		}
	return $value;
}
?>

You should also have function_exists("mysql_escape_string"); as a condition. While real_escape_string may be better, if the version of PHP is so old that it doesn't have real, it might have the legacy mysql_escape_string, which is better than addslashes.