note 102794 deleted from security.database.sql-injection by danbrown

Note Submitter: info at foziasoft dot com 

----

function secure($array) {
        $newArray = array();
        foreach($array as $key => $value) {
            if (is_array($value)) {
                $newArray[$key] = secure($value);
            }
            else {
                $newArray[$key] = htmlspecialchars(stripslashes($value));
				$newArray[$key] = str_ireplace(
											array (
													'*',
													'#',
													'SELECT ',
													'UPDATE ',
													'DELETE ',
													'INSERT ',
													'DROP ',
													'--',
													'1=1',
													'INTO',
													'VALUES',
													'FROM',
													'LEFT',
													'JOIN',
													'WHERE',
													'LIMIT',
													'ORDER BY',
													'AND',
													'OR ', 
													'DESC',
													'ASC',
													'ON '
												  ),
											  'BadChar',
											  $newArray[$key]
											);
				$newArray[$key] = mysql_real_escape_string($newArray[$key]);
            }
        }
        return $newArray;
    }

 if($_REQUEST){
	$_GET = secure($_GET);
    $_POST = secure($_POST);
 }