Bloquer des caractères ou chaine

<SCRIPT LANGUAGE="JavaScript">document.location.href="http://google.fr"</SCRIPT>

<?
include ("config.php");
if ($_POST["voiture"]) {
	$var=$_POST["voiture"];
	
	mysql_query("INSERT INTO vehicules VALUES(NULL, '$var', '1')");
	$x=mysql_query("SELECT * FROM vehicules ORDER BY id DESC LIMIT 1");
	while ($y=mysql_fetch_assoc($x)){
$id=$y['id'];
?>

<form onSubmit='return valid_form(this)' method="POST" action="index.php"  >

<input type="text" name="voiture" class="comments" maxlength="160" value=" " delay="1500" onblur="if(this.value=='') this.value='blablabla';" onfocus="if(this.value=='blablabla') this.value='' ;"/>
<p id="url"></p>

<!-- Bouton Creer Ma Page -->

<button id="create_button" type="submit" onSubmit='valid_form(this)' ></button>

$var=mysql_real_escape_string(htmlentities($_POST["voiture"]));

<?
include ("config.php");
if ($_POST["voiture"]) {
	$var=$_POST["voiture"];

	$new = htmlspecialchars($_POST["voiture"]);

	mysql_query("INSERT INTO vehicules VALUES(NULL, '$new', '1')");
	$x=mysql_query("SELECT * FROM vehicules ORDER BY id DESC LIMIT 1");
	while ($y=mysql_fetch_assoc($x)){
$id=$y['id'];
?>