PHP and Ajax String Input/Output Handling Scenario -

i'm still new string processing in php. below diagram of doing. ultimately, generic methodology handling strings in below scenarios. note text tends lot of math symbols , code syntax in scenario.

the strings , integer input via standard html-based form (i forgot mention in diagram).

step uses: mysql_real_escape_string(input);

step b uses:

• htmlentities($string2)
• nothing $string1
• nothing integer

questions:

1. regarding mysql injection, mysql_real_escape_string sufficient guard against this?
2. i still need finish processing output string1. note how text used in 2 different places: html and canvas. htmlentities @ step b make code syntax appear on html5 canvas not in html. vice-versa leaving out (html syntax breaks page). there javascript function identical php's htmlentities?
3. int form should validated make sure int.
4. string2 ouputs "null" html when use character ('–') not standard minus-sign character ('-').
5. magic quotes turned off. however, if run script on server enabled, need short script goes: if(magic quotes enabled){turn off magic quotes}.
6. what did forget in regard form validation?

if approach totally wrong, set me straight , me straightened out once , all. can describe solution in terms of a, b, c, d , e if think helpful. in advance.

1. mysql_real_escape_string() escape code
2. (a) on javascript end, jquery's .text() method escape code before outputting page. (b) check out php.js. it's javascript library replicates php functionality, , includes htmlentities() , htmlspecialchars(). http://phpjs.org/
3. as integer, can use ctype_digits() function ensure numeric value; , can use form of type hinting: $int = (int) $int;.
4. i agree gentleman recommended trying htmlspecialchars().
5. try keep magic quotes off. it's horrible feature, , removed in future release of php. if need include protection against magic quotes, try similar code below. (see bottom of post)
6. it's hard without seeing code, seems on right track.

-

if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {     $func = function(&$val, $key) {         if (!is_numeric($val)) {             $val = stripslashes($val);         }     };      array_walk_recursive($_get, $func);     array_walk_recursive($_post, $func);     array_walk_recursive($_cookie, $func);      unset($func); }