note 93514 added to security.database.sql-injection

Further to bendikt at armed dot nu below: <?php function sanitize(&$value, &$key) { $value = str_replace(array("'", '"', '\\'), '&prime;', $value); # replace single quote, double quote and backslash with HTML entity. $value = preg_replace('/[\s\x00\x1a]+/', ' ', $value); # replace any sequence of whitespace characters (spaces, tabs, line feeds, null chars, EOFs etc.) with one space. $value = trim($value); # remove extra spaces } array_walk_recursive($_GET, sanitize); array_walk_recursive($_POST, sanitize); # recursive as superglobals can contain deeper array structure. # rest of code... ?> ---- Server IP: 92.48.74.199 Probable Submitter: 78.105.118.2 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/93514 Del: integrated -- https://master.php.net/note/delete/93514/integrated Del: useless -- https://master.php.net/note/delete/93514/useless Del: bad code -- https://master.php.net/note/delete/93514/bad+code Del: spam -- https://master.php.net/note/delete/93514/spam Del: non-english -- https://master.php.net/note/delete/93514/non-english Del: in docs -- https://master.php.net/note/delete/93514/in+docs Del: other reasons-- https://master.php.net/note/delete/93514 Reject -- https://master.php.net/note/reject/93514 Search -- https://master.php.net/manage/user-notes.php