Regarding stripslashes(),
that should only be necessary if you have PHP's
magic_quotes_gpc feature turned on, which you shouldn't because it's deprecated. If you want to be robust, though, do if (get_magic_quotes_gpc()) $myusername = stripslashes($myusername); so that it removes a layer of slashes if and only if one was added.