Question

This is the sanitization function used in a book I recently learned from – Sams Teach Yourself Ajax, JavaScript, and PHP All in One.

I’ve been using it on my own PHP site. Is it safe for real-world usage?

function sanitizestring($var)
{
  $var = strip_tags($var);
  $var = htmlentities($var);
  $var = stripslashes($var);
  return mysql_real_escape_string($var);
}

Answer 1

I would say that is too general. It may be safe for a lot of uses, but it would often give unwanted side affects to strings. Not every string should be escaped like that.

• mysql_real_escape_string() should be used within SQL queries only. Better still, bind params with PDO.
• Why would you want to blanket strip tags and encode entities before inserting into a database? Maybe do it on the way out.
• For XSS prevention, htmlspecialchars() is more of your friend. Give it the character set as an argument.

So I would use mysql_real_escape_string() for queries, and htmlspecialchars() for echoing user submitted strings. There is also a lot more to know. Do some further reading.