PHP 防 SQL 注入 [ 新手入门 ]

/**
* 防sql注入
* @param  string $content
* @return string
*/
function sql_injection($content) {
    if (is_array($content)) {
        foreach ($content as $key => $value) {
            $content[$key] = trim($value);
        }

        if (false == get_magic_quotes_gpc()) {
            foreach ($content as $key => $value) {
                // 添加反斜杠
                $content[$key] = addslashes($value);
            }
        }

        foreach ($content as $key => $value) {
            // 转义%
            $content[$key] = str_replace('%', '\%', $value);
            // 转义_
            $content[$key] = str_replace('_', '\_', $value);
        }
    } else {
        // 去除空格
        $content = trim($content);
        if (false == get_magic_quotes_gpc()) {
            // 添加反斜杠
            $content = addslashes($content);
        }
        // 转义%
        $content = str_replace('%', '\%', $content);
        // 转义_
        $content = str_replace('_', '\_', $content);
    }

    return $content;
}