- // Replace with these characters
- 'from' => array("/", ".", "%", ":", "--")
-);
-
-// Overworked security part:
-if (is_array($_GET)) {
- foreach ($_GET as $seckey => $secvalue) {
- if (is_array($secvalue)) {
- // Throw arrays away...
- unset($_GET[$seckey]);
- } else {
- // Only variables are allowed (non-array) but we secure them all!
- foreach ($SEC_CHARS['from'] as $key => $char) {
- // Pass all through
- $_GET[$seckey] = str_replace($char , $SEC_CHARS['to'][$key], $_GET[$seckey]);
+ // Replace with these characters
+ 'from' => array('/', '.', "%", ':', "--")
+ );
+
+ // Overworked security part:
+ if (is_array($_GET)) {
+ foreach ($_GET as $seckey => $secvalue) {
+ if (is_array($secvalue)) {
+ // Throw arrays away...
+ unset($_GET[$seckey]);
+ } else {
+ // Only variables are allowed (non-array) but we secure them all!
+ foreach ($GLOBALS['security_chars']['from'] as $key => $char) {
+ // Pass all through
+ $_GET[$seckey] = str_replace($char , $GLOBALS['security_chars']['to'][$key], $_GET[$seckey]);
+ }
+
+ // Strip all other out
+ $_GET[$seckey] = strip_tags($_GET[$seckey]);
+ }