str-replace致命错误：只能通过引用传递变量

Question

I have this code as anti-html and sql injection for a online game but it doesn't work and gives me the following error:

    Fatal error: Only variables can be passed by reference

Here is my code:

    $_POST = str_replace('<', '>', '\'', '\'', '\\', '&lt;', '&gt;', '&quot;', '&#39; ', '&#92;', $_POST);
    $_GET = str_replace('<', '>', '\'', '\'', '\\', '&lt;', '&gt;', '&quot;', '&#39;', '&#92;', $_GET);

It's for the first of the two lines, but i'm sure that the problem will be for the second one too. I'm not good at php and these are files i took from the web. How can i solve this?

Answer 1

You don't need to implement your own XSS filter, as there is already existing one

And you can take advantage of this in this way:

$_POST = filter($_POST);
$_GET = filter($_GET);

function filter(array $value) {
        return is_array($value) ? array_map(__FUNCTION__, $value) : htmlentities($value);

}

This will filter nested arrays as well (in case your input was like name[])