Security

[moon 111]

I have a function that I use on all user input to prevent SQL injections, XSS etc. Am I missing anything? Anything else I should add?

 

<?php
function clean($var)
{
$var = mysql_real_escape_string($var);
$var = strip_tags($var);
}
?>

[ucffool]

Don't see anything wrong with it. If you are doing something that is more constructed (such as letters or numbers only), doing some extra regular expression checks will help (Also consider restricting the submitted content to a specific length to prevent a buffer overflow situation).

Another opinion would also be good, I'm not an end-all-be-all.

[darkfreaks]

<?php
function clean($var)
{
$var = mysql_real_escape_string(strip_tags(trim($var)));

}
?>

[maexus]

<?php
function clean($var)
{
return mysql_real_escape_string(strip_tags(trim($var)));
}
?>