Cleaning user input, is this safe enough?

[bachx]

I've written a small function that cleans up all user input before entering it to the DB. I'm wondering, is this sufficient or am I missing someting?

 

function clean_text($text) {

$text = str_replace("<", "<", $text);
$text = str_replace(">", ">", $text);
$text = strip_tags($text);
$text = htmlspecialchars($text, ENT_NOQUOTES);
$text = mysql_real_escape_string($text);

return $text;
}

[papaface]

You could just do:

function clean_text($text) {

$text = mysql_real_escape_string($text);

return $text;
}

If you want to make sure its safe for the SQL. But if you want to disallow certain tags, then yes your code is fine.