[zomgwtfbbq]

I have pretty much all the same things to say as above, BUT I'll recommend you use PDO for the db integration instead of mysqli. Why this? PDO provides single interface across multiple databases. That means you can use multiple DB without using mysql_query for mysql, mssql_query for MS sql etc. Just use something like $db->query("INSERT INTO..."). No matter what DB driver you are using.

http://php.net/manual/en/intro.pdo.php

Yes totally agree, I always use PDO. Here's a good read about preventing sql injections when using prepared statements.
http://stackoverflow.com/questions/13409...-injection.

Thanks Legolas, you put a lot of effort in your post. :Thumbs-Up: