title: A PHP function to prevent SQL Injections and XSS
body: <p>I am tring to make my PHP as secure as possible, and the two main things I am trying to avoid are</p>
  
  <ul>
  <li>mySQL Injections</li>
  <li>Cross-Side Scripting (XSS)</li>
  </ul>
  
  <hr>
  
  <p>This is the script I got against mySQL Injections:</p>
  
  <pre><code>function make_safe($variable) {
  $variable = mysql_real_escape_string(trim($variable)); 
  return $variable;  }
  </code></pre>
  
  <p><a href="http://www.addedbytes.com/writing-secure-php/writing-secure-php-1/">http://www.addedbytes.com/writing-secure-php/writing-secure-php-1/</a></p>
  
  <hr>
  
  <p>Against XSS, I found this:</p>
  
  <pre><code>$username = strip_tags($_POST['username']);
  </code></pre>
  
  <hr>
  
  <p>Now I want to unite the two into a single function. Would this be the best way to do so? :</p>
  
  <pre><code>function make_safe($variable) {
  $variable = strip_tags(mysql_real_escape_string(trim($variable)));
  return $variable; }
  </code></pre>
  
  <p>Or does the <strong>mysql_real_escape_string</strong> already prevent XSS? And lastly, is there anything else that I could add into this function to prevent other forms of hacking?</p>