// Sanitize input to prevent SQL injection function sanitize_input($input) { if (is_array($input)) { return array_map('sanitize_input', $input); } return preg_replace("/[^a-zA-Z0-9\s\-\.\,\/\@]/", "", $input); }