php - Efficiently sanitize user entered text -
i have html form accepts user entered text of size 1000, , submitted php page stored in mysql database. use pdo prepared statements prevent sql injection. sanitize text entered user, best efforts needed ? i want prevent script injection, xss attacks, etc. security interesting concept , attracts lot of people it. unfortunately it's complex subject , professionals wrong. i've found security holes in google (csrf), facebook (more csrf), several major online retailers (mainly sql injection / xss), thousands of smaller sites both corporate , personal. these recommendations: 1) use parameterised queries parameterised queries force values passed query treated separate data, input values cannot parsed sql code dbms. lot of people recommend escape strings using mysql_real_escape_string() , contrary popular belief not catch-all solution sql injection. take query example: select * users userid = $_get['userid'] if $_get['userid'] set 1 or 1=1 , th...