Protecting my html forms from injection

Question

I have a text box on my site that allows the use of html formatting to allow the users to make the text more presentable.

I use this code to protect most inputs to my db.

function clean($str) {
    $str = @trim($str);
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    return mysql_real_escape_string($str);
}

What i don't want it to do is remove html elements like <p> and <strong>

is there a better way to protect the inputs in text areas?

Answer 1

I only use mysql_real_escape_string() when inserting data to my DB and remove Tags like <script> (and some others) after pulling it from the DB. I think there are a few regexes out there.

Answer 2

The first line of defense against injections is using prepared statements. If you use prepared statements for your queries then it really doesn't matter what the user puts into your form because you have already separated code from data. The database will see any code that a user injects as just data rather than code. So not only do you get the benefit of protecting yourself from injection, but your code is actually cleaner and more thought out as well.