I'm working on a website which was built few years ago in PHP and its riddled with vulnerabilities all over the place. Someone has already gained access to the admin panel and we want to secure the websites, and prevent future break-ins.
Simplest, but tedious solution is to go through each file manually and replace all mysql queries with prepared queries and sanitize all inputs. However, I want to know if there's a simpler solution which could act as a layer between user input (GET, POST, COOKIE, SERVER) and the website logic, and filter out all suspicious looking input data.
I did some research and came across PHPIDS, but I couldn't figure out if it had ability to sanitize the inputs too. Is PHPIDS ideal for this task? Is there something better that suits this purpose?