<?php
/**
 * anti.php - IMPROVED VERSION
 * Original only used htmlspecialchars which does NOT prevent SQL injection.
 * Added stripslashes + strip_tags (already there) but note:
 * All database queries should ALSO use mysqli_real_escape_string() for SQL safety.
 * This function is for XSS protection; SQL safety needs prepared statements or escaping at query time.
 */
function anti_injection($data) {
    // Trim whitespace
    $data = trim($data);
    // Remove backslashes added by magic quotes (legacy)
    $data = stripslashes($data);
    // Strip HTML tags
    $data = strip_tags($data);
    // Convert special HTML characters to prevent XSS
    $data = htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
    return $data;
}
