1
2
3

foreach($_POST as $pname => $pvalue){
    $_POST[$pname] = str_replace(array("\\", '\\'), array("\'", '\"'), htmlspecialchars(trim($pvalue)));
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

<?php
if(isset($_POST['asdasd'])){
foreach($_POST as $pname => $pvalue){
    $_POST[$pname] = str_replace(array("\\", '\\'), array("\'", '\"'), htmlspecialchars(trim($pvalue)));
}
print_r($_POST);
}else{
?>
<form action="" method="post">
<input name="asdasd222" value="ssssssssssss" />
<input name="asdasdas" value="ssssq42345'''" />
<input name="asdasdastt" value="ssssq42345'''" />
<input type="submit" name="asdasd" value="test" />
</form>
<?php
}

1
2
3
4
5
6
7
8
9

function secure_input($v) {
    if ( is_array($v) ) {
        return array_map('secure_input', $v);
    }
    else {
        return htmlspecialchars(trim($v));
    }
}
$_POST = secure_input($_POST);

1
2
3
4
5
6
7

$variable_1 = secure_input($_POST[$variable_1]);
$variable_2 = secure_input($_POST[$variable_2]);
$variable_3 = secure_input($_POST[$variable_3]);

echo variable_1;
echo varia  ... etc

1
2
3
4
5
6
7
8

<?php
function secure_input(&$v) {
    if(is_array($v)) foreach($v as $i => $a) secure_input($v[$i]);
    elseif(is_string($v)) $v = htmlspecialchars(str_replace("'", "''", trim(get_magic_gpc()? stripslashes($v) : $v)));
    return true;
}
secure_input($_POST);
?>

1
2
3

If you use this code, you can no longer insert those strings into a DB, unless you want corrupted data, or unless you manually unescape them before doing so.

A nicer approach is to wrap the strings in a class, like SecureString, and have methods like toHtml(), toSql(), getRaw(), etc.