sql防注入代码

function defend_sql($string, $force = 1) {
    $preg = "select|insert|and|or|update|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile";
    if(!get_magic_quotes_gpc() || $force) {
        if(is_array($string)) {
            foreach($string as $key => $val) {
                $string[$key] = daddslashes($val, $force);
            }
        } else {
             if (preg_match("/".$preg."/is",$string) == 1){
                $string = preg_replace("/".$preg."/is","",$string);
            }
            $string = addslashes($string);
        }
    }
    return $string;
}