title: Automating insertion of mysql_real_escape_string
body: <p><strong>DISCLAIMER:</strong> I UNDERSTAND THE FUNCTIONS ARE ON TOP OF THE TO-DO-DEPRECATION LIST. ALL WARNINGS ARE JUST PREACHING TO THE CHOIR.</p>
  <p>anyway. I have found myself in the employment of a company using the mysql_* functions. That isnt bad enough aparently because the entire thing is without <code>mysql_real_escape_string()</code> &quot;great&quot;. All user input is unsanitzied, so naturally being the new code monkey, my job is to incorporate it into all 4.93g of php scripts. F.M.L. &quot;So&quot;, i thought to myself, &quot;what if i just unset the <code>$_REQUEST</code> array on each page (not sure why but they never used <code>$_POST</code> or <code>$_GET</code> once in the entire program, they literally used <code>$_REQUEST</code> everywhere.) and then reset it with <code>mysql_real_escape_string</code>?&quot;. To me, that sure beats going through 1000000000 lines of code. <strong>SO</strong> I sat down and wrote the function to do it. Here is where im at:</p>
  <pre><code>/*lets say input is dirty and input2 is boy*/
  
      echo &quot;&lt;br&gt;&lt;pre&gt;&quot;;print_r($_REQUEST);echo &quot;&lt;/pre&gt;&lt;br&gt;&quot;;
  
  $tempString = implode(',', $_REQUEST);
  $tempString2 = implode(',', array_keys($_REQUEST));
  $tempArray = explode(',', $tempString);
  $tempArray2 = explode(',', $tempString2);
  $count = count($_REQUEST);
      echo &quot;&lt;br&gt;&lt;pre&gt;&quot;;print_r($tempArray);echo &quot;&lt;/pre&gt;&lt;br&gt;&quot;;
  
      echo &quot;&lt;br&gt;&quot;;
      echo &quot;&lt;br&gt;&lt;pre&gt;&quot;;print_r($tempArray2);echo &quot;&lt;/pre&gt;&lt;br&gt;&quot;;
  
  unset($_REQUEST);
     $_REQUEST = array();
     for($i = 0; $i &lt; $count; $i++){
         $_REQUEST[$tempArray2[$i]] = &quot;mysql_real_escape_string(&quot;.$tempArray[$i].&quot;)&quot;;
     }
  
      echo &quot;&lt;br&gt;&lt;pre&gt;&quot;;print_r($_REQUEST);echo &quot;&lt;/pre&gt;&lt;br&gt;&quot;;
  </code></pre>
  <p>As far as i can tell it is working!:</p>
  <pre><code>Array
  (
      [input] =&gt; dirty
      [input2] =&gt; boy
  )
  
  
  Array
  (
      [0] =&gt; dirty
      [1] =&gt; boy
  )
  
  
  
  Array
  (
      [0] =&gt; input
      [1] =&gt; input2
  )
  
  
  Array
  (
      [input] =&gt; mysql_real_escape_string(dirty)
      [input2] =&gt; mysql_real_escape_string(boy)
  )
  </code></pre>
  <p>but frankly it seems too easy. immediate issues i see are</p>
  <ol>
  <li>it only works for <code>$_REQUEST[]</code></li>
  <li>You have to hard code it at the top of every page, even if you set it as a global function and include it</li>
  <li>If one thing goes wrong...</li>
  <li>mysql_* functions suck i.e. <a href="https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string"><code>mysql_real_escape_string</code></a></li>
  </ol>
  <p>as a side note, i can't even tell you how many times i have fought to switch everything from PDO, as you can imagine they dont like the amount of time that would require.</p>
  <p><strong>SO</strong></p>
  <p>I suppose what im bringing this here to you guys for is, a second pair of eyes. do you see any immediate issues with this? any other <em>immediate issues</em> that i missed? If you guys like this, in any way, as im sure there are other people who could use something like this (if you build it they will come), ill go aheaad and through it on github and work it into my shcedule, thanks :)</p>