note 99202 deleted from function.preg-replace by salathe

Note Submitter: vallini at gmail dot com Reason: bad code ---- Don't ever do this error with preg_replace, with the nifty idea you're obtaining a string containing only A-Z chars, numbers and spaces or apexes: <?php $escapedData=preg_replace('/[^0-9A-Za-z\s\']/', '', $escapedData); //remove unwanted inputs ?> If the data is escaped indeed, ready to be passed to the database, you have removed the escaping slashes too, duh! Any apex may now prevent database write, or allow injection exploit. Sanitization must be done before escaping, or may lead to whatever.