If you take user inputs and use the functions strip_tags() and addslashes(),...

[Kibret]

Will it pretty much solve every threat?

 

*and for database queries, mysql_real_escape_string()

 

 

What other functions are there?

[SchweppesAle]

Will it pretty much solve every threat?

 

*and for database queries, mysql_real_escape_string()

 

 

What other functions are there?

 

use mysql_real_escape_string() instead.  They'll be removing addslashes() from PHP6.

 

In terms of security, if you want to be on the safe side you can cast your variables as well. 

 

//after fetching the variable $tableID

$tableID = (int)$tableID;

 

etc