php - Efficiently sanitize user entered text -

i have html form accepts user entered text of size 1000, , submitted php page stored in mysql database. use pdo prepared statements prevent sql injection. sanitize text entered user, best efforts needed ?

i want prevent script injection, xss attacks, etc.

security interesting concept , attracts lot of people it. unfortunately it's complex subject , professionals wrong. i've found security holes in google (csrf), facebook (more csrf), several major online retailers (mainly sql injection / xss), thousands of smaller sites both corporate , personal.

these recommendations:

1) use parameterised queries
parameterised queries force values passed query treated separate data, input values cannot parsed sql code dbms. lot of people recommend escape strings using mysql_real_escape_string(), contrary popular belief not catch-all solution sql injection. take query example:

select * users userid = $_get['userid'] 

if $_get['userid'] set 1 or 1=1, there no special characters , not filtered. results in rows being returned. or, worse, if it's set 1 or is_admin = 1?

parameterised queries prevent kind of injection occuring.

2) validate inputs
parameterised queries great, unexpected values might cause problems code. make sure you're validating they're within range , won't allow current user alter shouldn't able to.

for example, might have password change form sends post request script changes password. if place user id hidden variable in form, change it. sending id=123 instead of id=321 might mean change else's password. make sure validated correctly, in terms of type, range , access.

3) use htmlspecialchars escape displayed user-input
let's user enters "about me" this:
</div><script>document.alert('hello!');</script><div>
problem output contain markup user entered. trying filter blacklists bad idea. use htmlspecialchars filter out strings html tags converted html entities.

4) don't use $_request
cross-site request forgery (csrf) attacks work getting user click link or visit url represents script perfoms action on site logged in. $_request variable combination of $_get, $_post , $_cookie, means can't tell difference between variable sent in post request (i.e. through input tag in form) or variable set in url part of (e.g. page.php?id=1).

let's user wants send private message someone. might send post request sendmessage.php, to, subject , message parameters. let's imagine sends request instead:

sendmessage.php?to=someone&subject=spam&message=viagra! 

if you're using $_post, won't see of parameters, set in $_get instead. code won't see $_post['to'] or of other variables, won't send message. however, if you're using $_request, $_get , $_post stuck together, attacker can set parameters part of url. when user visits url, inadvertantly send message. worrysome part user doesn't have anything. if attacker creates malicious page, contain iframe points url. example:

<iframe src="http://yoursite.com/sendmessage.php?to=someone&subject=spam&message=viagra!"> </iframe> 

this results in user sending messages people without ever realising did anything. reason, should avoid $_request , use $_post , $_get instead.

5) treat you're given suspicious (or malicious)
have no idea user sending you. legitimate. attack. never trust user has sent you. convert correct types, validate inputs, use whitelists filter necessary (avoid blacklists). includes sent via $_get, $_post, $_cookie , $_files.

if follow these guidelines, you're @ reasonable standing in terms of security.