Cleaning form inputs ??? [PHP]

[Chippiewill]

What procedures should I use when cleaning form inputs so they can't do injections and other crap like that?

[Zak]

mysql_real_escape_string will protect against injection

I usually use

$example = mysql_real_escape_string(htmlentities(trim($_POST['example']))));

[triston220]

^You've got an extra bracket.^


function Sanitise($input){
return mysql_real_escape_string(strip_tags(html_entities( trim($input))));
}

[Zak]

^You've got an extra bracket.^


Lmao yeh ****. Well spotted :P +rep

[triston220]

Lmao yeh ****. Well spotted :P +rep

Hah, thanks. :P

[Chippiewill]

Do I need to use strip slashes at all?

Edit: If I'm hashing a string do I need to bother cleaning it before hand?

[triston220]

To be honest, you don't really need to sanitise any input if you are hashing/encrypting it, unless the encryption/hash type uses special characters which would intefere with the query.

[Chippiewill]

I'm only using sha256 so I assume that's safe?

[triston220]

I'm only using sha256 so I assume that's safe?

Pretty much, yes.