function sec($deyisken){

return mysql_real_escape_string(trim(($deyisken)));

}

function xss($deyisken){

return strip_tags(trim(($deyisken)));

}

<?php
//include funksiyani ve s
$id=sec($_GET['id']);
//mysql_connect ve s
$query="SELECT * FROM news WHERE news_id=$id";

mysql_query($query);

?>

<?php
// isset() ...
$test = strip_tags((string)$_GET['test']);

print '<input type="text" name="test" value="'.$test.'">';

test.php?test=nese"+onfocus=alert()+autofocus+a

<?php
// isset() ...
$test = htmlspecialchars((string)$_GET['test']);

print "<input type='text' name='test' value='$test'>";

test.php?test=nese' onfocus=alert() autofocus a

$test = htmlspecialchars((string)$_GET['test'],ENT_QUOTES);