please i want to know how to avoid hacker from hacking my website using forms

i wrote only in the post:

PHP Code:

htmlspecialchars($_POST['first_name']); 


notice that i made validation using javascript to my form..
but hackers can make sql statment to delete my DB or any type of hacking..


but my question is : can the code htmlspecialchars avoid hacking from forms?? or how to avoid it??




how to stop hackers or avoid them from hacking my website??

To avoid SQL injection, use:

PHP Code:

$me = mysql_real_escape_string($_POST['first_name']); 


To avoid HTML injection as well, try this:

PHP Code:

$me = mysql_real_escape_string($_POST['first_name']);
$me = strip_tags($me); 


yes we can tnx

but does it work?

Originally Posted by swarz

but does it work?

Your 2 posts dont make sense?

As above:
$me = mysql_real_escape_string($_POST['first_name']);

Will work fine.

ANY! data you pass to a SQL database, run though the mysql_real_escape_string
function and you wont need to worry about injections.

yes ok thank you

Ah, I was only using htmlspecialchars(), thanks for this