where is reZen now :p

thanks for the code

You should have read my post ;)

Wow this is hilarious. Kids and their games. Next time you want to post pure crap just through up a link to rotten.com or ogrish or something and quit wasting everyones time with your absolute shit code. Have you done NO research on this subject at all? And if you had THIS IS WHAT YOU CAME UP WITH?

$_GET = filter($_GET);
$_POST = filter($_POST);
$_COOKIE = filter($_COOKIE);

I.E

> I use the iconv function to force an encoding set on the supplied data
> I loop through each $_POST and $_GET and set the values that way (as kuza55 suggested [cookie not included as this is only an idea to get you going])

Finally, there is a small bug in my code (intentional for this post) so post back if you can find how to make it throw an error, should be easy :)

oh and as a final thought, generally you might want to trim the string straight up to a fixed length you know you can handle it with whatever you want to do.

$value){
			$_POST[$name] = santize($value);
		}
	}
	
	// Clean any supplied get values
	if(isset($_GET)) {
		foreach($_GET as $name => $value){
			$_GET[$name] = santize($value);
		}
	}
?>

 $var) {
				$safe_html[$key]=recurs_escape_html($var);
			}
		} else {
			return htmlentities($data, ENT_QUOTES, 'ISO-8859-1');
		}
		return $safe_html;
	}
?>

Thanks for the comments.

Kuza55 you are right – $_REQUEST _can_ be problematic in some setups but this is example is more to show on how you can build an easy to extend first solution to cope with global input filtering – which I really rarely come to see during work. It of course no ‘use it and be happy forever’ solution but a snippet to point into a certain direction.

Greetings,
.mario

return strip_tags(str_replace($search, $replace, $string)

should be

return strip_tags(str_replace($search, $replace, $string));

Furthermore editing $_REQUEST does not change the values in $_GET, $_POST, $_COOKIE, etc. SO you would need to do this to every array you want to sanitize, and then reconstruct $_REQUEST from your already filtered initial arrays.

This is purely IMO, but $_REQUEST seems like a bad idea, since you don’t know where the stuff your working with came from, especially considering it relies on the variables_order directive.

Anyway, this seems pretty much identical to magic_quotes so I’m not going to bother criticising it since the arguments for/against magic_quotes have been rehashed enough times already.