I've got legacy PHP code which attempts to prevent script/SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
if(!is_array($_POST{$k}))
{
$val=str_replace("&","&",htmlentities($v,ENT_QUOTES));
$$k=$val;
//$_POST{$k}=$val;
if (!get_magic_quotes_gpc())
$_POST{$k}=$val;
else
$_POST{$k}=stripslashes($val);
}
}
}
The same is exactly replicated for $_GET as well.
Is this enough to prevent script/SQL injection?