URL checking function returns false? PHP -

first of all, not sure @ all, of sql injections, xss attacks etc, occurs via url, using parameters.

so wondered, if clean them , detect if there illegal word, if yes, exit 404 page.

so function:

    private static function cleanpath()     {         if (isset($_get))         {             $count      = 0;             $illegal    = array              (                 '<?', '<?php', '?>', '(', ')',                 '{', '}', 'select', '*', 'from',                 'where', 'select', 'from', 'where',                 'delete', 'delete', 'echo', 'print',                 'html', 'div', 'class', 'function',                 'prepare', 'query', 'execute', 'exec_',                 '_', '++', 'bindvalue', 'static',                 '$'             );              foreach ($illegal $i)             {                 foreach ($_get $key => $value)                 {                     $check = strpos($key, $i);                     if (!$check)                     {                         $count++;                     }                 }             }              if ((int)$count == count($illegal))             {                 return true;             }             else             {                 echo $count . ' array count:' . count($illegal) . '<br />';                 return false;             }         }     } 

but seems function doesn't work correctly.

and enter link: ?section=register&sec

it return false.

when enter link: ?section=register&section

it return true, , if enter besides section, return false. why doing that?

as see debugged that, , that's returns:

62 array count:31 

so $count = 62 , array count = 31

why go 62? looks doubling counter. did wrong?

going logic, if ok, actual comparison check be:

if ((int)$count == (count($_get) * count($illegal))) 

since counter being incremented every parameter every illegal term.

having said that, approach use problem impossible extensive, let alone complete.

it better sanitize inputs , use programming constructs prevent illegal values being processed (as anigel mentioned, whitelisting want), search wrongdoing constructs.