Hi all,

I just had one question what the best way to take input from a form and make sure its secure as I been doing bit research and so far I found stuff like

stripslashes
mysqli_real_escape_string
strip_tags
htmlentities

whats the best or is it case of using them all ??

Well, they all do different things, and you should read the manual to understand what they do.
All of them are used to avoid at the highest possible factor sql injection, but they are not security related in any way.

If you want a for secure, then only use an SSL enabled site.
Do not store unencrypted password.
Encrypt them with a non reversible algorithm, and use a different seed for each users.
Challenge every action the user can make.
Prevent form forging by using a hash in each form, that would change on every page access. Then a user could not simply send a form from nowhere and gain access, he would need to go through your pages to do so.

Making a system secure is not done by using a given function, but by making the most complicated possible to people trying to get in without the right informations.

Hi thanks the reason I asked if I am reading a book on PHP and MYSQL and it says that you should use mysqli_real_escape_string on any input from a form.

Like I said, real_escape_String is just a function that prevent sql injection.
Using it don't make a form secure.
And beside, and a lot of people don't realize this, you must have an open connection to a mysql db to use this.
Otherwise, you will get back an empty string.
http://www.php.net/manual/en/functio...ape-string.php

Notes

Note: A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used.

Note: If magic_quotes_gpc is enabled, first apply stripslashes() to the data. Using this function on data which has already been escaped will escape the data twice.

Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.