I have make a simple function for security prevent from sql injection and XXS here is my code, any suggestion for this? Is this good enough for security?
function mres($input){
if(get_magic_quotes_gpc()){
$input=stripslashes($input);
}
$input=htmlentities($input, ENT_COMPAT, 'UTF-8');
return mysql_real_escape_string($input);
}
This is wrong in at least two ways:
magic_quotes completely if you can. At least you are not using it, but $input may not be scalarhtmlentities is for display, not storage. Never encode for storage!mysql_* functions are deprecated. There is no guarantee you will have an open mysql connection (required) when you call it either.https://www.php.net/manual/en/function.mysql-real-escape-string.php
PDO.Look what you're actually doing:
Magic quotes is a bulk escaping of all incoming data, which makes you vulnerable, as escaping alone doesn't make your data "safe" by any means.
So, you are cleaning these bulk escapes... and then apply the very same escaping again :)
mysql_real_escape_string and addslashes are not equivalent. Plus htmlentities encodes quotes that would be escaped.