title: Increasing understanding of validating a string with PHP string functions
body: <p>I've just started attempts to validate data in PHP and I'm trying to understand this concept better. I was expecting the string passed as an argument to the <code>$data</code> parameter for the <code>test_input()</code> function to be formatted by the following PHP functions.</p>
  
  <ol>
  <li><code>trim()</code> to remove white space from the end of the string</li>
  <li><code>stripslashes()</code> to return a string with backslashes stripped off</li>
  <li><code>htmlspecialchars()</code> to convert special characters to HTML entities</li>
  </ol>
  
  <p>The issue is that the string that I am echoing at the end of the function is not being formatted in the way I desire at all. In fact it looks exactly the same when I run this code on my server - no white space removed, the backslash is not stripped and no special characters converted to HTML entities. </p>
  
  <p>My question is have I gone about this in the wrong approach? Should I be creating the variable called <code>$santised_input</code> on 3 separate lines with each of the functions <code>trim()</code>, <code>stripslashes()</code> and <code>htmlspecialchars()</code>? </p>
  
  <p>By my understanding surely I am overwriting the value of the <code>$santised_input</code> variable each time I recreate it on a new line of code. Therefore the <code>trim()</code> and <code>stripslashes()</code> string functions will never be executed.</p>
  
  <p>What I am trying to achieve is using the <code>"$santised_input"</code> variable to run all of these PHP string functions when the <code>$data</code> argument is passed to my <code>test_input()</code> function. In other words can these string functions be chained together so that I only need to create <code>$santised_input</code> once?</p>
  
  <pre><code>&lt;?php
  
  function test_input($data) {
     $santised_input = trim($data);
     $santised_input = stripslashes($data);
     $santised_input = htmlspecialchars($data);
     echo $santised_input;
  }
  
  test_input("%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E\     ");
  
  //Does not output desired result "&amp;quot;&amp;gt;&amp;lt;script&amp;gt;alert('hacked')&amp;lt;/script&amp;gt;"
  
  ?&gt;
  </code></pre>