Member Biographies: Submit via Form to Database

You shouldn't use htmlspecialchars (you should be using htmlentities, btw) when inserting to the database. You only use that when sending the code to the user. htmlentities (and htmlspecialchars) make the text longer, since single-byte characters such as < become multiple bytes such as &lt;.

Say the user is limited to 255 characters of input (tinytext). If they entered 255 < characters, the data would truncate when being inserted into the database, because the htmlspecialchars/htmlentities string will be longer than 255.

Also, escaping magic quotes should be done globally at start instead of in a function. Your function will cause errors if the string being sent as a parameter isn't $_GET, $_POST, or $_COOKIE or if the variable is set mid-program.

e.g.
$_GET["test"] = "ha\\ha"; // set manually
echo EscapeString($_GET["test"]); // haha

e.g.
$myvar = "ha\\ha";
echo EscapeString($myvar); // haha

Your function will remove slashes that are supposed to be there, because it will assume the slashes were caused by magic quotes (which only affect the $_GET, $_COOKIE, and $_POST data that exists at start) instead of added manually.

Therefore, remove slashes at program start, so it doesn't affect variables that don't exist until mid-program.