Function to sanitize PHP input values

Question

I use this:

function safeClean($n)
{
    $n = trim($n);

    if(get_magic_quotes_gpc())
    {
        $n = stripslashes($n);
    } 

    $n = mysql_escape_string($n);
    $n = htmlentities($n);

    return $n;
}

To prevent any type of MySQL input or something like that. Whenever I use it to wrap around $ _POST, do the following:

$username = safeClean($_POST['user']);
$password = md5(safeClean($_POST['password']));
$vpassword = md5(safeClean($_POST['verify']));
$email = safeClean($_POST['email']);

It doesn’t even work, but I connected the .php functions, and the directory is correct, but it doesn’t work at all, because it just shows a blank page ... If I remove safeClean () from every $ _POST it works.

Why does this not work at all?

Answer 1

Try using mysql_real_escape_string(), not mysql_escape_string().

Answer 2

, - . , (, PDO) - SQL. ...

, , , . , , , , . - , , , , . , - .

Answer 3

.

get_magic_quotes_gpc , htmlentities , "" .

, - . .
, SQL-: PHP htmlspecialchars() ?

. , . : : http://www.ibm.com/developerworks/library/os-debug/

ini_set('display_errors',1);
error_reporting(E_ALL);

and this code to execute the request:

$result = mysql_query($query);
if (!$result) trigger_error(mysql_error());