这段代码是否真的可以防止SQL注入？(Will this code actually work against SQL-injection? [duplicate])

 
 
 可能重复： 
 PHP：最终的清洁/安全功能 
 
 
 我在这里找到了这段代码： http ： //snipplr.com/view/12853/clean-variables-from-sql-injections/ 
 
 作者声称： 
 
 
 
 这个小函数有助于解决SQL注入的常见安全问题，它可以清理任何全局变量，如$ POST，$ GET，$ _SERVER等，并转义不安全的字符。 
 
 
 这段代码安全吗？ 
 
function _clean($str){
  return is_array($str) ? array_map('_clean', $str) : str_replace("\\", "\\\\"
       , htmlspecialchars((get_magic_quotes_gpc() ? stripslashes($str) : $str)
       , ENT_QUOTES));
}

//usage call it somewhere in beginning of your script
_clean($_POST);
_clean($_GET);
_clean($_REQUEST);// and so on..
 
 请告诉我这是否安全，因为它看起来像陪审团操纵我。 

 
 
Possible Duplicate:
 PHP: the ultimate clean/secure function 
 
 
I found this code snippet here: http://snipplr.com/view/12853/clean-variables-from-sql-injections/
 
The author claims: 
 
 
 
This little function helps to fight common security issue with SQL injections, it can sanitize any global variable like $POST, $GET, $_SERVER etc and escape unsafe characters.
 
 
Is this code safe? 
 
function _clean($str){
  return is_array($str) ? array_map('_clean', $str) : str_replace("\\", "\\\\"
       , htmlspecialchars((get_magic_quotes_gpc() ? stripslashes($str) : $str)
       , ENT_QUOTES));
}

//usage call it somewhere in beginning of your script
_clean($_POST);
_clean($_GET);
_clean($_REQUEST);// and so on..
 
Please enlighten me whether this is safe, 'cause it looks jury-rigged to me.

原文：https://stackoverflow.com/questions/6164522