php page which accepts input after sanitizing the values
<p>I have a page which I modified to accept input from the user and then it will sanitize the input values and then compare the password. It will then re-route to another page. My only concern is the XSS and script insertion in the input values. Heres my Code:</p>

<pre><code>&lt;?php
/**
 * ****************************************************************************
 * Micro Protector
 * 
 * Version: 1.0
 * Release date: 2007-09-10
 * 
 * USAGE:
 *   Define your requested password below and inset the following code
 *   at the beginning of your page:
 *   &lt;?php require_once("microProtector.php"); ?&gt;
 * 
 *   See the attached example.php.
 * 
 ******************************************************************************/


$Password = 'testpass'; // Set your password here



/******************************************************************************/
   if (isset($_POST['submit_pwd'])){

// Clean up the input values 
foreach($_POST as $key =&gt; $value) {  
    $_POST[$key] = stripslashes($_POST[$key]); 

    $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key])); 
}

      $pass = isset($_POST['passwd']) ? $_POST['passwd'] : '';

      if ($pass != $Password) {
         showForm("Wrong password");
         exit();     
      }
   } else {
      showForm();
      exit();
   }

function showForm($error="LOGIN"){
?&gt;
&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd"&gt;
&lt;html&gt;
&lt;head&gt;
&lt;META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"&gt;
&lt;META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"&gt;
   &lt;title&gt;IMC - Authentication&lt;/title&gt;
   &lt;link href="style/style.css" rel="stylesheet" type="text/css" /&gt;
&lt;Script&gt;
&lt;!--
function capitalize(form) {
    value = form.value;
    newValue = '';
    value = value.split(' ');
    for(var i = 0; i &lt; value.length; i++) {
        newValue += value[i].substring(0,1).toUpperCase() +
        value[i].substring(1,value[i].length) + '';
    }
newValue = newValue.replace(/(&lt;([^&gt;]+)&gt;)/ig,"");
form.value = newValue;
}
--&gt;
&lt;/Script&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;center&gt;&lt;a href="http://www.test.com"&gt;&lt;img src="http://www.test.com/theImages/topLogo.png" border=0 /&gt;&lt;/a&gt;&lt;/center&gt;
&lt;br&gt;&lt;br&gt;&lt;br&gt;
    &lt;div id="main"&gt;
      &lt;div class="caption"&gt;&lt;?php echo $error; ?&gt;&lt;/div&gt;
      &lt;div id="icon"&gt;&amp;nbsp;&lt;/div&gt;
      &lt;form action="&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;" method="post" name="pwd"&gt;
    Your Name:
        &lt;table&gt;
          &lt;tr&gt;&lt;td&gt;&lt;input class="text" name="name" onBlur="capitalize(this);" maxlength=12 type="text" /&gt;&lt;/td&gt;&lt;/tr&gt;
        &lt;/table&gt; 
        Password:
        &lt;table&gt;
          &lt;tr&gt;&lt;td&gt;&lt;input class="text" name="passwd" maxlength=8 type="password" /&gt;&lt;/td&gt;&lt;/tr&gt;
          &lt;tr&gt;&lt;td align="center"&gt;&lt;br/&gt;
             &lt;input class="text" type="submit" name="submit_pwd" value="Login" /&gt;
          &lt;/td&gt;&lt;/tr&gt;
        &lt;/table&gt;  
      &lt;/form&gt;
   &lt;/div&gt;
&lt;/body&gt;
&lt;/html&gt;

&lt;?php   
}
?&gt;
</code></pre>

<p>Question: Is the above php page secure enough to ensure user won't be able to insert any  tag or perform a XSS attack?</p>

<p><strong>EDIT</strong>: 
$_POST[$key] = stripslashes($_POST[$key]); <strong>and</strong> $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key])); are ok to be included together?</p>
