Question

Ok, I’m trying to clean my code from injections, etc,etc. and I’m getting this fatal error:

Fatal error: Can’t use function return value in write context in….

Here’s the line where it throws the error:

$val=mysql_real_escape_string($val)=$_SESSION['val']=strip_tags($_POST['val']);

Why is it throwing this error?

UPDATE: ok, thanks for the answers, I moved mysql_real_escape_string($val) to another part in the code, this fixed the error.

Answer 1

You’re assigning a value (return of strip_tags that is stored in $_SESSION['val']) to a function !
I guess you want this:

$val=mysql_real_escape_string($_POST['val']);

and about using strip_tags on a http parameter look at this:
http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-gpc

Another thing to note:

Please stop writing new code with the ancient mysql_* functions. They are no longer maintained and community has begun the deprecation process. Instead you should learn about prepared statements and use either PDO or MySQLi. If you cannot decide, this article will help to choose. If you care to learn, here is a quite good PDO-related tutorial.