php - filtering form inputs -

php - filtering form inputs -

i have simple contact form name, email, select list, , textarea. in mailer php script i'm trying add together simple filter prevent sql injection or other forms of hacking.

for example, i'm using

$name = filter_input(input_post, 'name', filter_sanitize_special_chars);

is good?

firstly allow me tell 85% of protection methods done 2 functions.

htmlspecialchars mysql_real_escape_string

firstly if sends info site such $_post['name'], , wish utilize value on html side such <p>the next string: {$_post['name']} invalid</p> should create sure that value has been through htmlspecialchars, protect most of xss attempts

next injection, if value of $_post['name'] going database create sure utilize mysql_real_escape_string on value.

that give 100% protection sql injection, means db cannot run commands user, dont mean text should be.

the functions should utilize before inserting info database are

empty() or isset() trim() strlen() preg_match() filter_var , filter_input

this called validation , needed yout create sure info user submitting want such filter_var used validate email entered email , not blah blah

what tent do run clean function create sure imputed info clean htmlspecialchars

example:

function clean($array) { foreach($array $key => $val) { if(is_array($val)) { $array[$key] = clean($val); //recursive }else { $array[$key] = htmlspecialchars($val, ent_quotes); } } homecoming $array; }

then next create sure safe xss:

$_get = clean($_get); $_post = clean($_post);

so if tried submit <a href='test'>test</a> value converted <a href='test'>test</a&gt

php sql forms input filter