Eeek, or a third time.

strip_tags() removes all html and php tags from your string, so there is no need to do it again by adding the 2 regular expression replaces (both, which I might add, do esentially the same thing).

If code injection (assuming php code injection) was what you were trying to avoid, a single call to strip_tags() should provide proficient. I would still, however, use htmlspecialchars().

This wouldn't prevent SQL Injection.

This is simply not sufficient. It won't help with various encoding techniques and is no substitue for whitelisting input. If you expect an Interger, filter for an Interger.

http://ha.ckers.org/xss.html