Security Function for users, that are using SQL

Here is a security function that will stop SQL Injection from being made, if your using MYSQL too store Usernames, Passwords, API Keys and data like this!


function protect($variable)
{$var = strip_tags(mysql_real_escape_string(trim($variable)));
$strip = strip_tags($variable);
$sql = mysql_real_escape_string($strip);
$variable = trim($sql);
return $variable;
}

Jesus christ, get rid of that incredibly outdated shit, use mysql prepared statements and use htmlspecialchars when outputting to the page if you're not using a framework that does that for you. I am assuming you noticed "someone" was able to make it output javascript to the admin account of your website ^^

If you're using PHP, you really should be using PDO, see http://www.w3schools.com/php/php_mysql_prepared_statements.asp . Stripping tags and escaping isn't the answer (The former actually looses information).

Certainly escaping is the answer when outputting to the page though!