Security precautions in a popular website

[Zurev]

I'm coding for a fairly popular website, that will be used by a large group of people. I have two major concerns, securing the input that gets passed through to a MySQL database, and securing $_GET information. Since I'm coding all the scripts myself, I'm using this simple method to secure $_GET:

$action = $_GET['action'];
$action_possible = array("register", "login", "logout");

// If the action isn't register,login, or logout, Kill the script.
if (!in_array($action, $action_possible))
    {
           die();
        } 

I'm fairly confident that this method will work fine, though if you see a flaw, I'd appreciate the criticism.

Now for user input, all input inserted into the database is passed through an insert function, all user input is passed through this function:

function escape($input){
    if(get_magic_quotes_gpc())
        {
            $input = stripslashes($input);
        } else {
        $input = addslashes($input);
    }

        $input = mysql_real_escape_string($input);
        return $input;
} 

I appreciate any help or advice you have to offer, thank you.

[cranial-bore]

if(get_magic_quotes_gpc())
    {
        $input = stripslashes($input);
    } else {
    $input = addslashes($input);
} 

This seems weird. If magic quotes is on, then you remove the slashes.
If it was off then you add them.

So $input will vary depending on that setting. I think you were trying to get $input to be in a known state, without slashes, so you could use m_r_e_s()
Remove else { $input = addslashes($input); }

[Selkirk]

Just turn off magic quotes and forget about em.

Don't forget to escape your output.

[skunkbad]

Take a look at filter_input(). It's a good start for your filtering needs.

http://us.php.net/filter_input

I've been using CodeIgniter, and it takes care of all of this stuff so I don't have to think about it. I used to be a framework hater, so I know frameworks aren't for everyone. Something to consider though.

[lorenw]

Don't forget XSS, Google for
XSS cheat sheet

The first link will have a few things to try with your forms. I tried it on some of my foms and sure enough I got the JavaScript popup.

The soution to use is here.
http://htmlpurifier.org/

It really does work as advertised.

Just something other than injection to guard against.