mysql - mysql_real_escape_string vs custom function -

i have taken on development on project previous programmer. under influence of post forms correctly protected mysql injection using custom function. not experienced enough in hard code function of mysql_real_escape_string($input), have continued use custom functioned designed.

can lend advice if custom code correctly performing job of mysql_real_escape_string?

mysql_real_escape_string alternative??

function cleaninput($input) {    $search = array(     '@<script[^>]*?>.*?</script>@si',   // strip out javascript     '@<[\/\!]*?[^<>]*?>@si',            // strip out html tags     '@<style[^>]*?>.*?</style>@siu',    // strip style tags     '@<![\s\s]*?--[ \t\n\r]*>@'         // strip multi-line comments   );      $output = preg_replace($search, '', $input);     $output = stripslashes($output);     return $output; } 

your function removes string related html. (well, not everything, many things. or things, @ least.)

your function, however, doesn't prevent sql injection, things distinct each other. otoh, no problem put html stuff in database.

if want prevent sql injection, have prevent situation malicious input turns query like

select id users name='<string inserted>' 

into

select id users name=''; drop table users; --' 

by inserting string '; drop table users; -- query.

what malicious string? 's - without them (and few other things), string cannot become malicious. in order replacement, there function in mysql api - called mysql_real_escape_string().

pdo , parametrized queries in case , more "new-style", rather "old-style" mysql_real_escape_string() protects against injections - if utilized correctly , consequently.