To be awfully honest, this function is just an arbitrary collection of more or less useless or harmful and sometimes even contradicting procedures, most of which has nothing to do with security at all. Now to the most important part.
For prevent my website from sql injection i always use
Which is what you are doing wrong. You're not alone though, I list it as the most infamous PHP delusion. Citing from that page:
this function has absolutely nothing to do with safety or injections, merely escaping special characters in SQL string literals, making them immune to SQL injection as a side effect, but being utterly useless for any other query part, from a table name to a numeric literal. To protect from SQL injection, one should follow two simple rules:
- Any variable data literal (i.e. a string or a number) should be substituted with a parameter, whereas actual value should be sent to the query separately, through bind/execute process.
- All other query parts that happen to be added through a variable, should be explicitly filtered through a hardcoded list of allowed values.
Given raw mysqli is rather tough with prepared statements, I would strictly suggest to use PDO instead.
So the main idea that nothing related to SQL security should be in such a function at all.
Let's see what are you doing with malicious
- first, all tags get removed by
- then these symbols (already extinct from the text) get replaced with an empty string
- finally those non-existent characters get converted to HTML entities
If you ever ask me to define "overkill" I will just show you this function.
htmlspecialchars() alone should be enough to prevent XSS in the page body.
What is more important, you seems to be using this function on the data input which is wrong. A text should be formatted right before the output, according to the formatting rules for the certain medium. If you're outputting into HTML page body, it would be
trim() has nothing to do with security at all, you could use this function for convenience.
- on a side note, never even use this
@ operator. It is harmful for your programming experience.
stripslashes() as well, has nothing to do with security. Besides, this function is just useless, never doing anything sensible at all.
- Not to mention that
get_magic_quotes_gpc() is twice useless, returning a value that has been removed from PHP 10 years ago.
- get rid of this function
- to prevent SQL injection follow 2 rules from above
- to prevent XSS use
htmlspecialchars when outputting your data or any other appropriate formatting.