Cleaning/sanitizing user input before sending it to database

Looked through a lot of similar questions ,but most of the discussions are old and some functions are deprecated.

I have a "Contact us form" where users have to input username , email and a message and then submit button which stores the message in a database .

I did some simple pentation test using "Burp Suite" ,and I have a high risk of SQL injection attack because of this "Contact us form".

I did some search and all I found is this php function:

function cleanInput($input) {
    $search = array(
      '@<script[^>]*?>.*?</script>@si',   // Javascript tag
      '@<[\/\!]*?[^<>]*?>@si',            // HTML tags
      '@<style[^>]*?>.*?</style>@siU',    // Style tags
      '@<![\s\S]*?--[ \t\n\r]*>@'         // Multi-line
    );

    $output = preg_replace($search, '', $input);
    return $output;
}

which by the way worked well for html and Javascript tags .

and

function input_cleaner($input) {
    $input = trim($input);
    $input = stripslashes($input);
    $input = htmlspecialchars($input);
    return $input;
  }

So my question, what are the new and better methods for protecting my website from Html, Java Script , php and mysql attacks ?

Is using the following enough ?

• mysqli_real_escape_string
• trim
• stripslashes
• htmlspecialchars

Regards .