title: Globally Sanitizing $_GET and $_POST Variables for XSS and scope
body: <p>I'm trying to globally cleanse the variables my users/developers, marketers could use directly that might cause a security risk. </p>
  
  <p>Have I defined a global function they can wrap anything in and it sanitizes output for them? Yes.  Have I given presentations and lunch-n-learns on the evils of using vars passed in unsanitized?  Yes.</p>
  
  <p>So, here's something akin to what I'm trying to place in an include that's at the top of all of our pages for POST/GET, ect. </p>
  
  <pre><code>foreach($_GET as $key =&gt; $value) {
      $_GET[$key] =  cleanThisBaby($value,$key);
  }
  </code></pre>
  
  <p>Of course this works, but when these variables are used in other included pages farther down in the rendering, they're back to their unsanitized state.  </p>
  
  <p>Is there something I'm missing about their variable superglobal scope?  Is there something that could be "refreshing" those (like an errant session_start())?</p>