$v) { $_POST[$k] = htmlspecialchars(mysql_real_escape_string($v), NULL, ""); } foreach ($_GET as $k=>$v) { $_GET[$k] = htmlspecialchars(mysql_real_escape_string($v), NULL, ""); } foreach ($_REQUEST as $k=>$v) { $_REQUEST[$k] = htmlspecialchars(mysql_real_escape_string($v), NULL, ""); } }