title: Best way to defend against mysql injection and cross site scripting
body: <p>At the moment, I apply a 'throw everything at the wall and see what sticks' method of stopping the aforementioned issues. Below is the function I have cobbled together:</p>
  
  <pre><code>function madSafety($string)
  {
  
  $string = mysql_real_escape_string($string);
  $string = stripslashes($string);
  $string = strip_tags($string);
  return $string;
  
  }
  </code></pre>
  
  <p>However, I am convinced that there is a better way to do this. I am using FILTER_ SANITIZE_STRING and this doesn't appear to to totally secure. </p>
  
  <p>I guess I am asking, which methods do you guys employ and how successful are they? Thanks</p>