I wanted to know what is the best way to prevent SQL Injection & XSS in PHP.
To prevent SQL Injection, we can escape the user input using mysql_real_escape_string() along with strip_tags(). Can we do anything else to make it more secure.
And, to prevent XSS, we can use strip_tags() along with strong data validation at server side.
Also, while sending the output to browser, we can use htmlspecialchars() to prevent the browser from applying any unintended meaning to any special sequence of characters that may be found.
Anybody can tell me, what else can be done to prevent the same?
