Quote marks in settings

[JMatthewman]

Including a single quote mark ( ' ) in the ban notification (and presumably some/all of the other values editable on that page/ that use 'vars.php' causes a PHP error

"Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING, expecting ')' in /var/www/spacebukkit/app/webroot/vars.php on line 26 "

Either stronger escapes, auto filtering, or validation to prevent use of certain characters are needed.

(also able to submit non-numerical characters in what should be numeric only fields, such as refresh times, validation recommended)