Question

Now I am using the following function to secure my strings :

  function secure($data)
  {
    $data = trim($data);
    $data = htmlspecialchars($data);
    $data = str_replace("'", '"', $data);
    $search = array(chr(0xC2).chr(0xA0),chr(0xC2).chr(0x90),
                              chr(0xC2).chr(0x9D),chr(0xC2).chr(0x81),
                              chr(0xC2).chr(0x8D),chr(0xC2).chr(0x8F),
                              chr(0xC2).chr(0xAD),chr(0xAD));
    $data = str_replace($search, "", $data);
    return $data;
  }

Will this function be enought to secure strings?

Which methods will you use to secure your strings to insert into MySQL and to prevent bugs such as XSS in HTML page?

Answer 1

By saying ‘Secure my strings’ I am assuming you mean for output?

For DB output (which includes varaibles used in SELECT queries), use *_escape_string functions or even better use prepared statements with PDO objects.

For html output you should use htmlentities rather than htmlspecialchars

Additionally if running shell commands from input use escapeshellarg and escapeshellcmd