title: Should I mysql_real_escape_string the password entered in the registration form?
body: <p>When a user registers I <em>clean</em> the password with <code>mysql_real_escape_string</code> as follow  </p>
  
  <pre><code>$password = clean($_POST['password']); 
  </code></pre>
  
  <p>Before adding it into database I use :</p>
  
  <pre><code>$hashedpassword = sha1('abcdef'.$password);
  </code></pre>
  
  <p>and save it into mySQL.</p>
  
  <p>My question is should I clean it or am I protected that the password is hashed before adding it into the DB ?</p>