question about array_walk

[darkfreaks]

ok so i have a question i have a clean function that i wanna loop on all post variables so i tried calling it like this

 

<?php
//somehow leaking SQL injection
function clean($var){
$var=trim(strip_tags(mysql_real_escape_string($var)));
$var=htmlspecialchars($var,ENT_QUOTES);
return $var;

array_walk($_POST,'clean'); // arraying post variables and cleaning which doesnt work or leaks injection

?>

[flyhoney]

What is your question?

[Brian W]

cant use mysql_real_escape_string to prevent to leaking of SQL injection?

 

[darkfreaks]

i want to know why it doesn't work i tried looking for obvious errors there are non however it does not stop injection on my site.

[trq]

You need to pass by reference, and theres no need to return $var.

 

function clean(&$var){
  $var = trim(strip_tags(mysql_real_escape_string($var)));
  $var = htmlspecialchars($var,ENT_QUOTES);
}