title: Is htmlentities() and mysql_real_escape_string() enough for cleaning user input in PHP?
body: <p>I'm very new to PHP, basically I'm trying to create a commenting system for my site. I have the following function:</p>
  
  <blockquote>
    <p>$input = $_POST['comment'];</p>
    
    <p>function cleanUserInput($input) {
         $input = mysql_real_escape_string($input);
         $input = htmlentities($input);
         return $input; }</p>
  </blockquote>
  
  <p>So the question is, is mysql_real_escape_string alone sufficient to prevent sql injection? and is htmlentities() sufficient to prevent scripts, html and styles entered by the user from having actual effect and just be shown as text?</p>
  
  <p>Or do I need to add more to my function to make the input really harmless?</p>