Functie securizare php

[Gabriel Puscuta]

Uite aici poate te ajuta asta. Am scris-o mai demult.

function securizare(){
    $string = parse_url($_SERVER['REQUEST_URI'],PHP_URL_QUERY);
    parse_str($string, $output);
    foreach($output as $k => $v){
        $key = sanitize($k);
        $val = sanitize($v);
        $output_arr[$key] = $val;
    }
    if(isset($output_arr) && is_array($output_arr)) return $output_arr;
    else return false;
}

function sanitize($var,$santype=3){
    if($santype == 1){
        return strip_tags($var);
    }
    if($santype == 2){
        return htmlentities(strip_tags($var), ENT_QUOTES, 'UTF-8');
    }
    if($santype == 3){
        if(!get_magic_quotes_gpc()){
            return addslashes(htmlentities(strip_tags($var), ENT_QUOTES, 'UTF-8'));
        }else{
           return htmlentities(strip_tags($var), ENT_QUOTES, 'UTF-8');
        }
    }
} 

Exemplu de folosire:

//@exemplu: http://numedomeniu.ro/test.php?key=valoare

print_r(securizare());

$sec = securizare();
echo $sec['key']; //returneaza "valoare" 

Daca vrei sa folosesti $_GET, faci asa:

//@exemplu: http://numedomeniu.ro/test.php?key=valoare

$var = sanitize($_GET['key']);
echo $var; 

Sper sa-ti fie de folos. Daca nu te descurci intreaba.

LE: mysql_real_escape_string() folosesti la query-urile MySQL cu date din $_GET sau $_POST;

$y = sanitize($_GET['key']);
$sql = ("SELECT * FROM tabel WHERE x='".mysql_real_escape_string($y)."' ");
$result = mysql_query($sql);
//loop etc..