title: PHP - String Clean
body: <p>I'm starting a comment system for my website.  The problem is I want to use an HTML editor, but is not fully necessary.</p>
  
  <p>My problem is with the security.  How to secure the user input that I save in database? Because I show that input on my website and I want to prevent XSS, SQL Injection and other things like that. But I still want my users to be able to write any characters.</p>
  
  <p>For example, daniweb uses and HTML EDITOR (wysiwyg .</p>
  
  <p>I also tried </p>
  
  <pre><code>function bstring( $value )
  {
      $value = htmlentities( $value, ENT_QUOTES );
      $value = strip_tags( $value );
      $value = mysql_real_escape_string( $value );
      return (string)$value;
  }
  </code></pre>