in reply to Preventing injection attacks

That regexp won't even compile. You have an unescaped slash and an unescaped opening parenthesis in it. But when it does compile, I think it will match too much valid data. Like, what is the branch \s+\s supposed to catch?