PHP MySQL การดักจับข้อมูลที่ผิดปกติจากภายนอกเว็บไซด์ (SQLInjection, form data, get, post)

/********************************************************
* validate data from user submit request
* when user summit request from form on the page
* and data is risk to SQLInject input on the form data
* so this class is trap the data is risk or about the
* SQLInjection or contain sql command etc..
*********************************************************/
final class filtering{
	private static $_pattern = '/((select|insert|update|delete|alter|create|grant|drop)+|([a-z0-9\'\._]+[ \t]*(=|like)[ \t]*([a-z0-9\'%\)\(\*]+[ \t]*)+)+|([a-z0-9\'\._]+[ \t]+(is null|is not null))+)+/i';
	public static function filterGet(){
		if( !is_array($_GET) && count($_GET) === 0 ) return 0;
		foreach( $_GET as $v ){
			if( preg_match(filtering::$_pattern, $v) > 0 ){
				return 1;
				break;
			}
		}
		return 0;
	}


	public static function filterPost(){
		if( !is_array($_POST) && count($_POST) === 0 ) return -1;
		foreach( $_POST as $k=>$v ){
			if( preg_match(filtering::$_pattern, $v) > 0 ){
				return 1;
				break;
				//$_POST[$k] = preg_replace(filtering::$_pattern, '', $v);
			}
		}
		return 0;
	}


	public static function filterSession(){
		if( !is_array($_SESSION) && count($_SESSION) === 0 ) return 0;
		foreach( $_SESSION as $v ){
			if( preg_match(filtering::$_pattern, $v) > 0 ){
				return 1;
				break;
			}
		}
		return 0;
	}
}


$_POST = array('cust_name'=>'chairod phapa', 'cust_mobile'=>'0848399882', 'cust_addr'=>"69\\2 soi jariensak");
if( filtering::filterPost() === 1 ) print "<h1>Your data input into form data is risk and it scope in risk data please enter again</h1>";
else print "<h1>form data is usage !!!</h1>";