the issue was caused by the magic-quotes_gpc setting being turned on in the php.ini file.
we resolved by using stripslashes() on the form output.
to prevent the problem in the future I recommended using the following script at line 1 of the form page:
<?php
if($_SERVER["REQUEST_METHOD"] == "POST") {
foreach($_POST as $key => $val) {
$_POST[$key] = stripslashes($val);
}
}
?>