Question

I mainly want to prevent hacks that can be written via scripts through the send message and chose username fields.

function protect($v) {
    $v = mysql_real_escape_string($v);
    $v = htmlentities($v, ENT_QUOTES);
    $v = stripslashes($v);
    $v = trim($v);

    return $v;
}

Are the above php functions enough? I don’t need something super high security, just enough to have done all the basics right.

Answer 1

For basic security:

mysql_real_escape_string EVERYTHING when you do a SQL Query, htmlentities when you want to echo something from the database.

Example:

<?php
    $sql = " 
        SELECT 
            *
        FROM 
            table
        WHERE
            id = '". mysql_real_escape_string($_GET['id']) ."'
        LIMIT 1
    ";           // above this is the first security

    $mysql = mysql_query($sql);

    if($mysql){
        $result = mysql_fetch_assoc($mysql);

        echo htmlentities($result); // And here the second
    } 
?>