title: Sanitizing array values before mysql inserts
body: <p>I have the following code blocks in a PHP form-handler:</p>
  
  <pre><code>function filter($data) {
      $data = trim(htmlentities(strip_tags($data)));
  
      if (get_magic_quotes_gpc()) {
          $data = stripslashes($data);
      }
      $data = mysql_real_escape_string($data);
  
      return $data;
  }
  
  foreach($_POST as $key =&gt; $value) {
      $data[$key] = filter($value);
  }
  </code></pre>
  
  <p>I am modifying my form to now include checkbox groups:</p>
  
  <p>eg:</p>
  
  <pre><code>&lt;input type="checkbox" name="phone_prefs[]" value="prefer_home"&gt;
  &lt;input type="checkbox" name="phone_prefs[]" value="prefer_cell"&gt;
  &lt;input type="checkbox" name="phone_prefs[]" value="prefer_work"&gt;
  etc.
  </code></pre>
  
  <p>Because of this code I now have arrays in my _POST variables rather than just strings. </p>
  
  <p>Am I correct in thinking that my <code>filter()</code> function the will not actually sanitize arrays properly? What changes do I need to make to my <code>filter()</code> function to make sure the arrays for the checkboxes are sanitized completely and not an easy target for SQL injection attacks?</p>