[Help][PHP] Filtering/cleaning variables?

[twentyfour]

Hey everyone, just wanted to say this is my first post on any forum ever, so don't hurt my feelings.
^-^

While working on my retro that I started a couple months back, I've learned a good bit about PHP, but I'm still far from an expert. I'm fairly advanced with HTML and CSS, so I'm not a noob (unlike a lot of cheap hotel owners I see). However, I ripped some code from a cms sometime ago for the Homes page (honestly forgot which cms it was) and i saw this little bit of code:

function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}

I've seen some talk about cleaning variables and what not here on the forums, but why? If that code wasn't there how could a hacker exploit my cms? I use Rev btw.
Also, the CMS I'm building for my retro is almost complete, and I would really appreciate it if anybody experienced in server-side coding could test its security (ethically, of course). Just PM me.

 

[BIOS]

What exactly is this thread about, are you asking how to filter?

 

[Zodiak]

function filter($var)
{
    return mysql_real_escape_string(stripslashes(htmlspecialchars($var)));
}

Basically, the Escape string is there to stop people putting stuff like:

'; UPDATE `users` SET `rank` = '99'

The rest is there to stop html etc, so people can't put script tags, etc for redirections where there motto or whatever is displayed.

 

[twentyfour]

What exactly is this thread about, are you asking how to filter?

No not really, since most of my code appears already filtered and I can always just google. But since Google doesn't like specific queries, I was asking what would happen specifically to a habbo retro/cms if I didn't have that code, but @Zodiak answered.
How do I end thread?

 

[JayC]

Close Thread @Legion @Kaz @RastaLulz