LyokoHaCk

Is it possible to sanitize the whole global input variable array ($_POST or $_GET or $_REQUEST) variable array by doing or does it not work?

Thanks

Coma

I *think* you have to iterate over it, like this:
foreach ($_POST as &$v) $v=mysql_real_escape_string($v);

(edit: damn. If you put tags around PHP code [that can be evaluated] here, it'll get executed.)

LyokoHaCk

Will do. Thanks!

Escape the $ and _ like so: \$\_POST !

Dismounted

That code won't work, you're assigning all the values to $v, so you'll only get the last value, try something more like:

Starholdest

This is what I use for my scripts

<?php
//include into your mysql script

if($_POST) $_POST = array_map('mysql_real_escape_string',array_map('ht mlspecialchars',$_POST));
if($_GET) $_GET = array_map('mysql_real_escape_string',array_map('ht mlspecialchars',$_GET));
if($_COOKIE) $_COOKIE = array_map('mysql_real_escape_string',array_map('ht mlspecialchars',$_COOKIE));
?>

Of course this forum screws up the "htmlspecialchars" it's actually all one word.

__________________

Dismounted

If you're just going through an array, using foreach will be slightly faster.