Escaping Mulitple Checkbox Values

[Tenaciousmug]

Here is my code:

if (isset($_POST['remove']))
{
foreach ($_POST['msgid'] AS $msgid)
{
	$sql = "DELETE FROM inbox WHERE msgid = '".$msgid."' AND userid='".$_SESSION['userid']."'";
	mysqli_query($cxn, $sql) or die(mysqli_error($cxn));
}
}

 

It works perfectly fine, but to prevent SQL Injection and XSS, I put this:

if (isset($_POST['remove']))
{
foreach ($cxn-real_escape_string(htmlspecialchars($_POST['msgid'])) AS $msgid)
{
	$sql = "DELETE FROM inbox WHERE msgid = '".$msgid."' AND userid='".$_SESSION['userid']."'";
	mysqli_query($cxn, $sql) or die(mysqli_error($cxn));
}
}

 

But then it stops grabbing the value. :/ So... is there anyway I can prevent malicious attacks without preventing it from grabbing the value?

[Tenaciousmug]

Nevermind! Just had to do this:

if (isset($_POST['remove']))
{
foreach ($_POST['msgid'] AS $msgid)
{
	$msgid = $cxn->real_escape_string(htmlspecialchars($msgid);
	$sql = "DELETE FROM inbox WHERE msgid = '".$msgid."' AND userid='".$_SESSION['userid']."'";
	mysqli_query($cxn, $sql) or die(mysqli_error($cxn));
}
}