<?php
/**
 * Security Helper - Provides sanitization and security utilities
 */

if (!function_exists('clean')) {
    /**
     * Sanitizes input data to prevent XSS and generic injection
     * @param mixed $data String or Array to be cleaned
     * @return mixed Cleaned data
     */
    function clean($data)
    {
        if (is_array($data)) {
            foreach ($data as $key => $value) {
                $data[$key] = clean($value);
            }
        } else {
            $data = trim($data);
            $data = stripslashes($data);
            $data = htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
        }
        return $data;
    }
}

if (!function_exists('db_prepare')) {
    /**
     * Escapes data for safe use in MySQL queries (if prepared statements aren't used)
     * @param mysqli $con Database connection
     * @param string $data Data to escape
     * @return string Escaped data
     */
    function db_prepare($con, $data)
    {
        return mysqli_real_escape_string($con, clean($data));
    }
}

/**
 * Automatically clean $_POST and $_GET globally
 * Use with caution if you expect raw HTML input (e.g., in editors)
 */
function sanitize_globals()
{
    $_POST = clean($_POST);
    $_GET = clean($_GET);
    $_REQUEST = clean($_REQUEST);
}
?>