. Jordan .

Here's another which explains it
 
http://woork.blogspot.com/2009/02/useful-tips-to-design-horizontal.html

I've never worked with shadows in that perspective however I would try using a softer and sligthly less feathered shadow. I also found this little tutorial which might help http://www.techtut.com/Tutorial/Photoshop/11-Create-shadow-in-Photoshop.html

If it's just a sort of contact website for the business with a little about them then it's pretty nice. Only thing I would really think of changing is the text boxes. Currently they stand out a little much. The fact they also have a gradient seems strange due to the rest of the design being flat. Finally, think about who the website is for. You say it's for "branded gifts like umbrellas and all that jazz" so would it not make more sense to have a more colourful and (bad choice of word) happy design? Just my $0.02

Make a directory called "menu" and place the menu.html in there but rename it to index.html

http://uk3.php.net/mktime that page explains all

It simply prepends a backslash to \x00, \n, \r, \, ', " and \x1a characters... so its not exactly cutting edge protection.
 
To properly protect your database, you should be using prepared statements and filtering variables before using them.
 
See http://php.net/manual/en/pdo.prepared-statements.php for more on prepared statements and http://uk.php.net/manual/en/function.filter-var.php for more information on filtering variables.
 
You may also be interested in mod_security for greater server protection and PHPIDS, both of which will catch malicious code before it even gets to your PHP script.

It wouldn't stop someone entering their message as
'); DELETE FROM users WHERE 1=1; -- , but it would essentially treat it as a harmless string and the database would escape the data itself. The database driver already has the hard coded query and the placeholders, you're just telling it what data to enter in the placeholders, rather than the traditional generate the string on the fly based on escaped post vars. With prepared statements you're sending the values to the database and letting it build the query.
 
You don't need to use mysql_real_escape_string either as its a mysql function. You can use the PDO::quote function but its not necessary when using a prepared statement as the database will do it for you. Some more info here - http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html
 
I know its a bit more long winded and more technical than using mysql_real_escape_string but its much safer and far more professional to use PDO and prepared statements. Developers who are still using the mysql library functions are living in the stone age.