title: Cleaning/sanitizing user input before sending it to database
body: <p>Looked through a lot of similar questions ,but most of the discussions are old and some functions are deprecated.</p>
  <p>I have a &quot;Contact us form&quot; where users have to input username , email and a message and then submit  button which stores the message in a database .</p>
  <p>I did some simple pentation test using &quot;Burp Suite&quot; ,and I have a high risk of SQL injection attack  because of this &quot;Contact us form&quot;.</p>
  <p>I did some search and all I found is this php function:</p>
  <pre><code>function cleanInput($input) {
      $search = array(
        '@&lt;script[^&gt;]*?&gt;.*?&lt;/script&gt;@si',   // Javascript tag
        '@&lt;[\/\!]*?[^&lt;&gt;]*?&gt;@si',            // HTML tags
        '@&lt;style[^&gt;]*?&gt;.*?&lt;/style&gt;@siU',    // Style tags
        '@&lt;![\s\S]*?--[ \t\n\r]*&gt;@'         // Multi-line
      );
  
      $output = preg_replace($search, '', $input);
      return $output;
  }
  </code></pre>
  <p>which by the way worked well for html and Javascript tags .</p>
  <p>and</p>
  <pre><code>function input_cleaner($input) {
      $input = trim($input);
      $input = stripslashes($input);
      $input = htmlspecialchars($input);
      return $input;
    }
  </code></pre>
  <p>So my question, what are the new and  better methods for protecting my website from Html, Java Script , php and mysql attacks ?</p>
  <p>Is using the following enough ?</p>
  <ul>
  <li>mysqli_real_escape_string</li>
  <li>trim</li>
  <li>stripslashes</li>
  <li>htmlspecialchars</li>
  </ul>
  <p>Regards .</p>