PHP全站防注入

<?php //要过滤的非法字符
$ArrFiltrate=array("/",";","union");
//出错后要跳转的url,不填则默认前一页
$StrGoUrl="";
//是否存在数组中的值
functionFunStringExist($StrFiltrate,$ArrFiltrate)
{
foreach($ArrFiltrateas$key=>$value)
{
if(eregi($value,$StrFiltrate))
{
returntrue;
}
}
returnfalse;
}
//合并$_POST和$_GET
if(function_exists(array_merge))
{

$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);
}
else
{
foreach($HTTP_POST_VARS as $key=>$value)
{
$ArrPostAndGet[]=$value;
}
foreach($HTTP_GET_VARS as $key=>$value)
{ $ArrPostAndGet[]=$value;
}
}
//验证开始
foreach($ArrPostAndGet as $key=>$value)
{
if(FunStringExist($value,$ArrFiltrate))
{
echo"<scriptlanguage="javascript">alert("Neeao提示，非法字符");</script>";
if(empty($StrGoUrl))
{
echo"<scriptlanguage="javascript">history.go(-1);</script>";
}
else
{
echo"<scriptlanguage="javascript">window.location="".$StrGoUrl."";</script>";
}
exit;
}
}
?>