title: PHP/MySQL: Filtering POST & GET Data
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/3126072/what-are-the-best-php-input-sanitizing-functions">What are the best PHP input sanitizing functions?</a>  </p>
  </blockquote>
  
  
  
  <p>A while back I found this, what I thought to be great, snippet in someones code to filter POST and GET data from injections. </p>
  
  <pre><code>function filter($data) { //Filters data against security risks.
      $data = trim(htmlentities(strip_tags($data)));
      if(get_magic_quotes_gpc()) $data = stripslashes($data);
      $data = mysql_real_escape_string($data);
      return $data;
  }
  foreach($_GET as $key =&gt; $value) $filterGet[$key] = filter($value);
  foreach($_POST as $key =&gt; $value) $filterPost[$key] = filter($value);
  </code></pre>
  
  <p>And I've been using it ever since. But today, while sending an array through ajax I got tons of errors. Most of them say <code>strip_tags() expects parameter 1 to be string, array given in...</code></p>
  
  <p>What the best way to filter data? All this data is going to a database. But what about cases where it isn't going to a database? </p>