What is the right way to escape user input and output data's against xss and sql injection?
This is the one i wanted to use, i don't know if it is secured.

**This below as input**

function check_input($data) {
$data = trim($data);
$data = strip_tags($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
$data = filter_var($data, FILTER_SANITIZE_STRING);
return $data;
}


**Then use this below as the output**

echo htmlspecialchars($data, ENT_QUOTES, 'UTF-8');

or



echo htmlentities($data, ENT_COMPAT, 'UTF-8', false);