php - Filtering User Input -

i've read quite few q&a's on filtering user input here, of time answer depends on you're doing. here's i'm doing:

data submitted via form used in mysql query:

function clean($field, $link) {     return mysql_real_escape_string($field, $link); } 

data submitted via form displayed on html/php page or in email:

function output_html($value) {     return stripslashes(htmlspecialchars($value)); } 

data displayed database:

function output_db($value) {     return stripslashes($value); } 

is sufficient needs? there i'm not considering?

thanks!

use mysql_real_escape_string() when inserting strings sql queries, no matter input comes from.

use htmlspecialchars() or htmlentities() when inserting strings html code, no matter input comes from.

use urlencode() when inserting values query string of url, no matter values come from.

if data comes user, should these things because there chance user trying bad things. security aside--what if want insert legitimate string sql query , string happens have single quote character in it? still must escape it.