* quotemeta() wasn't the right function. addslashes() is correct.