Does this session script strong enough?

htmlspecialchars() is only cut special HTML chars from string =)
So, it don't cut ` or ' understand? )

 

htmlspecialchars is used to turn < into &lt; and > into &gt; as well as do this for various other html characters. It does not protect against sql injections.

In your case with MySQL you'd want to be using either
http://ca3.php.net/manual/en/function.mysql-escape-string.php

or

http://ca3.php.net/manual/en/function.mysql-real-escape-string.php

real being used when you have a connection so it can assume the right character set when escaping data.

 

I really appreciate your help & explaination guys,....it's clear for me.