Question

Possible Duplicate:
Does mysql_real_escape_string() FULLY protect against SQL injection?

In my page I created a form and what I want to do is when posting the field value in php coding I want to use both the strip_tags and mysql_real_escap_string as :

$res = stript_tags(mysql_real_escape_string($_POST['name']));

Is the above coding correct for secure submission of input field names or it creates any problem when submission.

Answer 1

In itself, this should work just fine. But personally, I’d advise you not to use mysql_real_escape_string at all. I believe I’m right in thinking you’re using the mysql_* extension, which is being deprecated. Do yourself a favour and switch to either PDO or mysqli_*, preferably PDO.

These are more modern extensions, that support prepared statments
see my answer here for a couple of links. Also, see Bobby tables on why prepared statements are a far safer bet than manually escaping data.

As @phant0m says: use of mysql_real_escape_string isn’t full-proof (see the link in his comment). There’s also a couple of pitfalls when using functions like strip_tags and especially stripslashes: when you’re processing data, it’s not unimaginable that, at some point, the data contains something like Foo\'s Bar, and, as the docs say:

If magic_quotes_sybase is on, no backslashes are stripped off but two apostrophes are replaced by one instead.

Try figuring out what the result of stripslashes(mysql_real_escape_string($data)); will be…

When using strip_tags, it’s important to note that the allowable tags will keep their attributes, which may contain slashes, colons, semicolons, dashes, quotes and various other chars you wouldn’t want to see messing up your query…
For more possible issues with strip_tags, have a look at this post