Question

I’m trying to make sanitize function to keep rest of the code simple.
Since I’m using MYSQLi I wonder if the following code is correct?

function sanitize ($data){
    global $db_connect;
    return htmlentities(strip_tags($db_connect->real_escape_string($data)));
}

function array_sanitize ($item) {
    global $db_connect;
    $item = htmlentities(strip_tags($db_connect->real_escape_string($item)));
}

Answer 1

I see two reasons why you sanitize the string:

Prevent from SQL injections

You should use prepared statements instead of using real_escape_string() to prevent from SQL injections. The Mysqli Extension supports prepared statements. They are most secure and easy to use. Use them.

Prevent from XSS attacks

To prevent from XSS attacks htmlentities() and strip_tags() may help. You should also make sure, that the functions handling the input charset correctly.

You should also read this document from OWASP