Php-MySql Security approach while INSERT’ing INTO MySql & fetching from MySql to screen -

my approach while insert’ing mysql

i think read in stackoverflow.com “if need escaping or similar action, in time need” in verification pages verify user inputs (null or not check, length check , structural checks (eg: mail structure, custom tags structures); use $_post[''] variables inputs. during verifications, in custom error printing parts, error messages not include of $_post[''] values in message texts.

interim note: utilize prepared statements , parameterized queries during php-mysql interactions. if inputs verified; before insert’ing mysql, strip tags input since don’t allow html tags other custom structured tags. (for example **bold text** === <strong>bold text</strong>) insert user input mysql db.

my approach while fetching mysql & printing output screen

i apply htmlspecialchars() command print out screen mysql db

my question

i not sure of myself. there obvious or hidden weakness in approach? in advance php gurus’ valuable comments. br

update

i won't strip tags during insert mysql db. reasons, please refer comments of Álvarog.vicario below. br.

the discussion far has been protecting sql injection , persistent cross site scripting. sounds you're on right track.

• your use of prepared statements "best practice" combat sql injection.
• htmlspecialchars() start prevent xss, have escape data in encoding scheme appropriate outputting data. owasp has comprehensive page discusses this: xss (cross site scripting) prevention cheat sheet. short answer: ensure using "the escape syntax part of html document you're putting untrusted data into."