A PHP function to prevent SQL Injections and XSS

Question

I am tring to make my PHP as secure as possible, and the two main things I am trying to avoid are

mySQL Injections
Cross-Side Scripting (XSS)

This is the script I got against mySQL Injections:

function make_safe($variable) {
$variable = mysql_real_escape_string(trim($variable)); 
return $variable;  }

http://www.addedbytes.com/writing-secure-php/writing-secure-php-1/

Against XSS, I found this:

$username = strip_tags($_POST['username']);

Now I want to unite the two into a single function. Would this be the best way to do so? :

function make_safe($variable) {
$variable = strip_tags(mysql_real_escape_string(trim($variable)));
return $variable; }

Or does the mysql_real_escape_string already prevent XSS? And lastly, is there anything else that I could add into this function to prevent other forms of hacking?

A PHP function to prevent SQL Injections and XSS

3 Answers