Sanitzing input on form submit with PHP
You should first ask yourself this: Why am I sanitizing input in this way?

Let's say I have a login form, and the user enters his credentials, an email and a password. The email will be queried against the database, to figure out the user's hashed password (You are hashing your passwords, right?!), and the password would be hashed, to be compared against that hash.

Both of those fields will never be outputted to HTML, the password is never kept in plain-text form for very long, and the username is queried against the database and then discarded. So why should you escape them for HTML?



Sanitizing (or more accurately named, Escaping), contrary to popular belief should not be done when you receive your input. It should be done right before you output it. Because at the time you receive your input, you have no idea where it's going to be used. It could be outputted to HTML (in which case it needs htmlspecialchars()), it could be outputted to JSON for an AJAX response (in which case it needs json_encode()), it could be stored in the database (in which case it needs prepared statements).

The general rule is: You escape as late as possible. HTML strings should be escaped right before they get echoed onto an HTML page.



What you should be doing when receiving your input, and as early as possible, is validating the input, i.e. making sure the input matched what you expect in format, and in business logic. Format means "This is a valid email address", and business logic means "This comment that the user is trying to edit, really belongs to him".