Question while reading Learning PHP, MySQL & JavaScript by Robin Nixon RE: Sanitizing Input PHP [duplicate]

Question

I'm currently reading and learning PHP from a book that offers this as the proper way to sanitize input from forms:

function mysql_entities_fix_string($connection, $string) 
{
return htmlentities(mysql_fix_string($connection, $string));
}

function mysql_fix_string($connection, $string)
{
  if (get_magic_quotes_gpc()) $string = stripslashes($string);
  return $connection->real_escape_string($string);
}

Which is great, except I know that get_magic_quotes_gpc() is deprecated in the current version of PHP. From looking at a few different resources I learned that instead of using get_magic_quotes_gpc() I should just use an sql prepared statement. That confuses me though because I would presume that we still need to do some functional cleaning of the string.

Unless I'm wrong(it happens, I'm relatively new at this) this is a big no-no, regardless of the prepared statement:

$username = $_POST['username'];
$stmt = $conn->prepare("SELECT password FROM users WHERE username=?");
$stmt->bind_param("s", $username");
$stmt->execute();
...

but if that's the case, is this an acceptable sanitation process:

function get_post($conn, $var) {
return $conn->real_escape_string($_POST[$var]);
}
...
$username = get_post($conn, 'username');
$stmt = $conn->prepare("SELECT password FROM users WHERE username=?");
$stmt->bind_param("s", $username);
$stmt->execute();
...

or do I need to add some other escaping function on top of it?

Answer 1

Uh no. That sanitization code is garbage.

Your proposed sanitization process with PDO statements is fine. That is all you need.