Question

What else do you think would be a great tool to prevent form injection, URL injection, or any other kind of injection?

Not too specific to the code, just the big picture.

Answer 1

filter your input / validate your output

That’s it. For avoiding script injections, or any other kind of Cross-site Scripting, you need to ensure that any character displayed on the webpage as part of text is not any of the 5 special html characters. Use htmlspecialchars to encode them to their equivalent html entities (which are displayed normally, but not processed by the html engine):

• & becomes &
• > becomes >
• < becomes &lt;
• ‘ becomes &#039;
• ” becomes &quot;

For SQL injection, the principle is the same, avoid special SQL characters in your queries, by using mysql_real_escape_string, mysqli_real_escape_string, pg_escape_string, PHP Data Objects (PDO) or prepared statements.

To avoid shell commands injection, you need to avoid another set of characters. Use escapeshellcmd and escapeshellarg.

And for other mediums, other characters are involved, and other functions needed. As someone said in a comment, there is no silver bullet.