title: Secure all inputs in PHP form
body: <p>My form has several types of inputs including text, checkbox and radio.  I'd like to make sure the form is secure.  I used the Prestashop functions isGenericname and isCleanHTML to check the text and comment fields by ensuring the fields are valid.  </p>
  
  <p>Prestashop Validate.php </p>
  
  <pre><code>public static function isGenericName($name)
    {
      return empty($name) || preg_match('/^[^&lt;&gt;={}]*$/u', $name);
    }
  
  public static function isCleanHtml($html, $allow_iframe = false)
    {
      $events = 'onmousedown|onmousemove|onmmouseup|onmouseover|onmouseout|onload|onunload|onfocus|onblur|onchange';
  
      if (preg_match('/&lt;[\s]*script/ims', $html) || preg_match('/('.$events.')[\s]*=/ims', $html) || preg_match('/.*script\:/ims', $html))
          return false;
  
      if (!$allow_iframe &amp;&amp; preg_match('/&lt;[\s]*(i?frame|form|input|embed|object)/ims', $html))
          return false;
  
      return true;
    }
  </code></pre>
  
  <p>This is how the function is called in the form PHP file.</p>
  
  <pre><code>if (!Validate::isCleanHtml($message))
      $this-&gt;errors[] = Tools::displayError('Invalid message');
  elseif (!Validate::isGenericName($fname))
      $this-&gt;errors[] = Tools::displayError('Invalid First Name.');
  </code></pre>
  
  <p>So my question are.  Is it ok to not produce an error message for inputs such as check boxes and radio box that are not valid?  The only reason they'd be invalid was if someone hacked he code before sending.  Or is there a better way to strip and secure the inputs?</p>
  
  <pre><code>$checkbox = Tools::getValue('checkbox ');
   if (!Validate::isGenericName($checkbox ))
      $validCheckbox = $checkbox;
  </code></pre>
  
  <p>I have 68 inputs I want to make sure are secure.  Is there a good PHP function that can strip out and stop any sort of SQL injection? Prestashop documents state "getValue() does not protect your code from hacking attempts (SQL injections, XSS flaws and CRSF breaches). You still have to secure your data yourself."  I'm thinking I'll need to scrub it all through trim(), stripslashes(), htmlspecialchars() but I didn't know of the most efficient way.</p>