Smart or Dumb?

[The Little Guy]

I decided to make this code, and place it in an include that is in the header of every file.

 

When a user sends information via POST or GET, it automatically performs mysql_real_escape_string on all the POST / GET values, so when I use them on the db, I don't have to do it for every variable (hope that makes sense).

 

Is this a good idea, or is this a really bad idea?

 

foreach($_GET as $k => $v){
$_GET[$k] = mysql_real_escape_string($_GET[$k]);
}
foreach($_POST as $k => $v){
$_POST[$k] = mysql_real_escape_string($_POST[$k]);
}

[trq]

Its probably not the smartest idea. Firstly, mysql_real_escape_string needs a database connection to work. Secondly, who's to say all of your POST & GET data is going to end up within the database.

 

This is allot like having magic quotes enabled, which has been desiabled now by default in php and for good reason.

 

Validate and escape your data as you need to.