/** PREVENT SQL INJECTION **/
if (!preg_match('/^[\s\(\)\,\.\!\?\'\\a-zA-Z0-9]+$/i', $user) OR $user == "")
	$error = "<login bSuccess='0' sMsg='Username must contain letters, spaces or numbers!'/>";
else if (!preg_match('/^[\s\(\)\,\.\!\?\'\\a-zA-Z0-9]+$/i', $pass) OR $pass == "")
	$error = "<login bSuccess='0' sMsg='Password must contain letters and numbers!'/>";