Don't clean them; just use prepared statements. If little bobby tables wants to enter his name, let him (unless it violates a business rule about name format, in which case validate for that rule).