[SOLVED] Is this overkill to prevent injection attacks?

[tqla]

Hello. Will this effectively prevent the $_POST["text'] field from being used to attack my database? Or is it overkill? Thanks.

$text= htmlentities(strip_tags(trim(mysql_real_escape_string($_POST["text"]))));

 

[GingerRobot]

It's overkill. You only need to be using mysql_real_escape_string to prevent the injection. That is plenty sufficient. You might like to use some of the other functions when you output the data, but probably not before. As a general rule of thumb, you should be looking to preserve the original text as much as possible in the database -- for the simple reason that the specifications might change. You might find that, at some point in the future, you really did want any html tags left in, for example.

[tqla]

Thanks GR!