note 92159 deleted from function.mysql-real-escape-string by philip

Note Submitter: isaacs dot brian dot c at gmail dot com ---- I had wanted to see the merits of dynamically and "automatically" applying mysql_real_escape_string() to $_GET and $_POST as arrays rather than manually each time I would type up a query. I used array_walk_recursive() to call my function "mysql_safe" to apply mysql_real_escape_string() to each key of the $_GET and $_POST arrays. My function is part of a class, and it is called each time I connect to the database to perform a query: <?php class MyClass { function mysql_safe ( $key, $item, $type ) { switch( $type ) { case 'get': if( count( $_GET ) > 0 ) { $_GET[$item] = mysql_real_escape_string( $key ); } break; case 'post': if( count( $_POST ) > 0 ) { $_POST[$item] = mysql_real_escape_string( $key ); } break; } } function safe_get ( ) { #Flag to only run function once if( $this->get_flag == true ) { return true; } array_walk_recursive( $_GET, array( $this, 'mysql_safe' ), 'get' ); array_walk_recursive( $_POST, array( $this, 'mysql_safe' ), 'post' ); $this->get_flag = true; } } ?> However, after using this function, I find that it does indeed work, it also creates new $_GET and $_POST values in which $item and $key are swapped. So I end up with $_GET[$item] = $key, as well as $_GET[$key] = $item. I have not yet determined if this is due to the actual coding itself, or my particular method of implementation. [EDIT BY danbrown AT php DOT net: Contains a bugfix by "Anonymous" on 13-JUL-09 to reorder the user function parameters.]