Not convinced this is a good idea. Your devs will learn to trust $_GET "because it's cleaned by our include". They'll never sanitise input themselves "because

Not convinced this is a good idea. Your devs will learn to trust $_GET "because it's cleaned by our include". They'll never sanitise input themselves "because it's cleaned by our include". Code that they write for other projects will trust $_GET "because it's cleaned by our include" - except it's not because this is a 3rd party script. Code you import from other projects will be double-escaping. Also mysql_real_escape_string is deprecated. Stop treating SQL queries as strings. They're code. You wouldn't write code by concatenating strings with user input would you? Use prepared statements. edit: missed the part when you said that you clean $_POST as well. I was wondering "What do you do when you need to submit markup?" Now I know that it's magic. The $_REQUEST array is actually the unsanitised array, whereas $_POST is the sanitised one. Of course! Isn't it obvious! Sigh.