Dize-

<object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/ebopIWPoXI0?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/ebopIWPoXI0?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>

Ne veritabanında saklanan alır -

<object width=\"480\" height=\"385\"><param name=\"movie\" value=\"http://www.youtube.com/v/ebopIWPoXI0?fs=1

Zaten kullanarak - mysql_real_escape_string() ile yardımcı olmuyor &:

$_POST['desc'] = mysql_real_escape_string($_POST['desc']);
mysql_query('INSERT INTO user_showcase( title, description, user_id, date_n_time) VALUES( "'.$_POST['title'].'", "'.$_POST['desc'].'", "'.$_SESSION['uid'].'", NOW())') or die(mysql_error());
mysql_close($con);

HTML -

<textarea id="desc_in" cols="40" rows="10"></textarea>