How would I protect it from html and php code and SQL code?

Thanks

U can use htmlspecialchars() function or create your own function
for example

PHP Code:

InSql($string){
$string = eregi_replace(" +", " ", $string);
$string = str_replace("<", "& #060;", $string); 
$string = str_replace(">", "& #062;", $string); 
$string = str_replace("\"", "& #034;", $string); 
$string = str_replace("'", "& #146;", $string);
return $string;
}