SQLi Avoidance through global blacklist "fallback"

[oz11]

Is this a good idea.. in a layered security sorta way...

if ($_SERVER["REQUEST_METHOD"] == "GET" || $_SERVER["REQUEST_METHOD"] == "POST") {
    // List of SQL injection terms to blacklist
    $sqlInjectionTerms = array('DROP', 'DELETE', 'UPDATE', 'INSERT', 'SELECT', 'AND', 'TRUNCATE', 'UNION', 'SELECT * FROM');

    // Function to check for SQL injection terms in request parameters
    function checkForSqlInjection($requestData, $sqlInjectionTerms) {
        // Check if $requestData is an array
        if (!is_array($requestData)) {
            return; // Exit function if $requestData is not an array
        }

        foreach ($requestData as $param => $value) {
            // Check if $value is a string
            if (!is_string($value)) {
                continue; // Skip iteration if $value is not a string
            }

            foreach ($sqlInjectionTerms as $term) {
                if (stripos($value, $term) !== false) {
                    // Detected potential SQL injection; terminate script execution
                  //  die("Potential SQL injection detected in parameter: " . htmlspecialchars($param));
                  echo $string = "FLAG:".bin2hex(random_bytes(10));
                  echo "<br>";
                  die (" error: 000ajfw5");
                }
            }
        }
    }

    // Check for SQL injection in GET parameters
    if ($_SERVER["REQUEST_METHOD"] == "GET") {
        checkForSqlInjection($_GET, $sqlInjectionTerms);
    }

    // Check for SQL injection in POST parameters
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        checkForSqlInjection($_POST, $sqlInjectionTerms);
    }
}

yes, I already use PDOs.

Edited April 28 by oz11

[oz11]

nevermind. it sucks.. i tried. We all fail somtimes.

Spoiler

Spoiler