Question

I am creating a function for my $_POST inputs to prevent SQL Injection BEFORE adding the values into database. I use it on login/register and when a user needs to post an article. As far as I know, this does not secure it from XSS.

Should I create a different function when I output data or edit this?

Thank you.

function clean($str) {
    $str = @trim($str);
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    return mysql_real_escape_string($str);
}

Answer 1

Try using prepared statements. They are designed to automatically escape things. They should also keep your queries cleaner in the source code.

• http://www.ultramegatech.com/blog/2009/07/using-mysql-prepared-statements-in-php/
• http://php.net/manual/en/mysqli.prepare.php
• http://php.net/manual/en/book.pdo.php