Question

I know $_REQUEST is bad because it contains cookie data as well.

Is it still bad to use $_REQUEST if we use some sort of clean function to it? Would someone be able to elaborate?

Answer 1

$_REQUEST is not specifically dangerous. Any user input can be an attack and should be treated as such. For any input medium $_GET, $_POST, $_COOKIE, use an appropriate method intval(), preg_match(), … to verify that the value you receive is something you expect.

For example if you expect a file name and intend to send it to the user, make sure it does not contain .. or / so the user won’t be able to access your filesystem.

If you want to insert a user generated value in a database, make sure you are escaping your values, using the old mysql_real_escape_string, or better PDO or mysqli prepared statements.