After looking further into it, your right. All the str_replaces are really doing is what mysql_real_escape_string() is doing. Thanks for pointing that out.