Please don't send me a link to php.net referencing mysql_real_escape_string as the only response. I have read through the page and while I understand the general concepts, I am having some trouble based on how my INSERT statement is currently built.

Today, I am using the following:

$sql = "INSERT INTO tablename VALUES ('', '$_SESSION['Member1FirstName'], '$_SESSION['Member1LastName'], '$_SESSION['Member1ID'], '$_SESSION['Member2FirstName'], '$_SESSION['Member2LastName'], '$_SESSION['Member2ID'] ....

and the list goes on for 20+ members with some other values entered. It seems most people in the examples already have all their data stored in an array.

On my site, I accept form inputs, action="" is set to self, php validation takes place and if validation passes, data is stored into SESSION variables on page 2 then redirected to the next page in the process (page 3) (approximately 8-10 pages in the whole process).

thanks!