Does this look right for a decent user input sanitizer

[woocha]

<?php  
function sanitize($value)  
{    
   if(get_magic_quotes_gpc())     
   {      $value = stripslashes($value);    
    }    else     {      
           $value = $value;    }  

  mysql_real_escape_string($value);   
  return $value;  
}?>

Its something I slapped together....do you guys think it makes good sense as a function?

[AdRock]

I got this from w3schools.com

 

function check_input($value)
{
    // Stripslashes
    if (get_magic_quotes_gpc()){
	$value = stripslashes($value);
    }
    // Quote if not a number
    if (!is_numeric($value)){
	$value = mysql_real_escape_string($value);
    }
    return $value;
}

[trq]

Numeric or not, your data should be escaped. Theres a fair bit of redundant code in there, but otherwise, it along with validation should be sufficient.

 

<?php  
function sanitize($value) {    
 if (get_magic_quotes_gpc()) {
   $value = stripslashes($value);    
 }
 return mysql_real_escape_string($value);     
}
?>

[woocha]

Theres a fair bit of redundant code in there

 

OH DUH !!

 

Thanks  ...but other than that, you think this should be good for allowing users to login into and register to my site.....STRICTLY SPEAKING ABOUT SQL INJECTION, no other validations

[trq]

Yeah. Of course you still need to validate your data is what you expect.

[Stooney]

You could also expand on it to detect and sanitize entire arrays of data at once.  I find that handy.