Question

I had a question to clarify the best method for taking form data and writing it to a mysql database in the safest way to prevent database attacks while also stripping html tags. Below I have a function called form_write that does this and then I use it in my code when declaring each of the post form variables.

function form_write($string)
  {
     return mysql_real_escape_string(strip_html_tags($string));
  }

 $name = form_write($_POST['name']);
 $email = form_write($_POST['email']);
 ...etc

Would be grateful if anyone could take a look and let me know if I am on the right track or if there is a better way to be doing this.

Thanks

Answer 1

Yes, stripping the tags and escaping the input makes it safe. Later you can add an extra validation layer to input variables. For example to validate the e-mail, you can use:

if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    throw new Exception('Invalid e-mail address');
}

PHP has a lot of filters, see filter_var and the list of filters.