Safely storing and output data

Question

On my application I use this method to store and to output the data. I would like to know if it is safely and correct.

##store the data###
//sanitize
function clean($testo)
{
 $config = HTMLPurifier_Config::createDefault();
 $purifier = new HTMLPurifier($config);
 $testo = $purifier->purify($testo);
 $testo = mysql_real_escape_string($testo);
 return $testo;
}
$value = clean($_POST[value]);
//the clean function contain mysql_real_escape_string and htmlpurifier class
$sql = mysql_query("insert into table values(null,$value);");
##output the data####
$sql = mysql_query("select * from table");
$val = mysql_fetch_array($sql);
function echoValue($valore){
 $valore = htmlspecialchars(strip_tags(stripslashes($valore)), ENT_QUOTES, "UTF-8");
 return $valore;
}
echo echoValue($val);
// the echoValue function contain strip_tags and htmlentities

• Daniel Lisik: mysql is deprecated. Instead use PDO or mysqli: php.net/manual/en/intro.mysql.php
• Funk Forty Niner: Read up on the subject because it is not.
• WizKid: And it is impossible to answer without knowing what clean looks like
• VMai: Both functions seems to falsify the content. I don't consider this as a "correct" behaviour. No need to add something about using mysql_* functions in new code.
• user3348353: i have add the code of the two functions

Answer 1

To "Safely" store data, please don't use mysql_* functions. Use PDO or mysqli.

Also, use PreparedStatements wherever you use "where" clause in queries. That will protect you against injection.

https://www.php.net/pdo.prepared-statements

• user3348353: it is a huge application, to convert everything into PDO will take long time, there is not other ways? to fix this code?
• Sasanka Panguluri: There's no other way. I personally did many such things to achieve security and clean code. Better be safe than sorry.
• Sasanka Panguluri: Both are easy. I would prefer PDO.