title: PHP Sanitize Data
body: <p>I am new to the world of coding and PHP hence would like to learn what's the best way to sanitize form data to avoid malformed pages, code injections and the like. Is the sample script I found below a good example?</p>
  
  <p>Code originally posted at <a href="http://codeassembly.com/How-to-sanitize-your-php-input/" rel="noreferrer">http://codeassembly.com/How-to-sanitize-your-php-input/</a></p>
  
  <pre><code>/**
   * Sanitize only one variable .
   * Returns the variable sanitized according to the desired type or true/false 
   * for certain data types if the variable does not correspond to the given data type.
   * 
   * NOTE: True/False is returned only for telephone, pin, id_card data types
   *
   * @param mixed The variable itself
   * @param string A string containing the desired variable type
   * @return The sanitized variable or true/false
   */
  
  function sanitizeOne($var, $type)
  {       
      switch ( $type ) {
      case 'int': // integer
          $var = (int) $var;
          break;
  
      case 'str': // trim string
          $var = trim ( $var );
          break;
  
      case 'nohtml': // trim string, no HTML allowed
          $var = htmlentities ( trim ( $var ), ENT_QUOTES );
          break;
  
      case 'plain': // trim string, no HTML allowed, plain text
          $var =  htmlentities ( trim ( $var ) , ENT_NOQUOTES )  ;
          break;
  
      case 'upper_word': // trim string, upper case words
          $var = ucwords ( strtolower ( trim ( $var ) ) );
          break;
  
      case 'ucfirst': // trim string, upper case first word
          $var = ucfirst ( strtolower ( trim ( $var ) ) );
          break;
  
      case 'lower': // trim string, lower case words
          $var = strtolower ( trim ( $var ) );
          break;
  
      case 'urle': // trim string, url encoded
          $var = urlencode ( trim ( $var ) );
          break;
  
      case 'trim_urle': // trim string, url decoded
          $var = urldecode ( trim ( $var ) );
          break;
  
      case 'telephone': // True/False for a telephone number
          $size = strlen ($var) ;
          for ($x=0;$x&lt;$size;$x++)
          {
              if ( ! ( ( ctype_digit($var[$x] ) || ($var[$x]=='+') || ($var[$x]=='*') || ($var[$x]=='p')) ) )
              {
                  return false;
              }
          }
          return true;
          break;
  
      case 'pin': // True/False for a PIN
          if ( (strlen($var) != 13) || (ctype_digit($var)!=true) )
          {
              return false;
          }
          return true;
          break;
  
      case 'id_card': // True/False for an ID CARD
          if ( (ctype_alpha( substr( $var , 0 , 2) ) != true ) || (ctype_digit( substr( $var , 2 , 6) ) != true ) || ( strlen($var) != 8))
          {
              return false;
          }
          return true;
          break;
  
      case 'sql': // True/False if the given string is SQL injection safe
          //  insert code here, I usually use ADODB -&gt; qstr() but depending on your needs you can use mysql_real_escape();
          return mysql_real_escape_string($var);
          break;
      }       
      return $var;
  }
  </code></pre>