Is my security ok?

[Anonymous]

no it won't

You have the right idea but you call mysql_real_escape_string and then strip out all the slashes it just added.

You should remove the call for stripslashes. That will get you exactly where you want to go.

You also don't technically need the htmlspecialchars call but that's more of a personal preference.

 

[Anonymous]

This right here should do you the trick.

$variable = trim(strip_tags(mysql_real_escape_string($_POST['variable'])));