title: PHP SQL injection and protection?
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/60174/how-to-prevent-sql-injection">How to prevent SQL injection?</a>  </p>
  </blockquote>
  
  
  
  <p>This is my attempt at cleaning up what I will be putting into my database</p>
  
  <pre><code>$pictureID = $_REQUEST['pictureID'];
  $userID = $_REQUEST['userID'];
  $username = $_REQUEST['username'];
  
  //Sanatize //Protext against injection
  
  $username = filter_var($username, FILTER_SANITIZE_EMAIL);
  $userID = filter_var($userID, FILTER_SANITIZE_STRING);
  $pictureID = filter_var($pictureID, FILTER_SANITIZE_STRING);
  
  $username = stripslashes($username);
  $username = mysql_real_escape_string($username);
  
  $userID = stripslashes($userID);
  $userID = mysql_real_escape_string($userID);
  
  $pictureID = stripslashes($pictureID);
  $pictureID = mysql_real_escape_string($pictureID);
  </code></pre>
  
  <p>I have two questions, is the above enough?</p>
  
  <p>Also, if I do <code>echo $pictureID</code> nothing appears, however, if I remove the <code>$pictureID = mysql_real_escape_string($pictureID);</code> then <code>echo $pictureID</code> works.</p>
  
  <p>Is this the correct behavior? </p>