Merci, mais alors comment empêcher l insertion de balise script en base de donnée ?

public function securizeVariables( $isAdmin = false ) {

		$this->isAdmin = $isAdmin;

		global $_;

		$_ = array();

		foreach($_POST as $key=>$val) {

		if( is_array($val) ) {
				$val = $this->copyTab($val);
			} else { 
				$val = $this->protectVar($val);
			}

			$_[$key]=$val;
		}

		foreach($_GET as $key=>$val) {

			if( is_array($val) ) {
				$val = $this->copyTab($val);
			} else {
				$val = $this->protectVar($val);
			}

			$_[$key]=$val;
		}
	}

	private function protectVar( $val ) {

		if($this->isAdmin) {
			$val = mysql_escape_string( $val );
		} else {
			$val = mysql_escape_string( htmlentities($val, ENT_QUOTES, "UTF-8") );
		}
	
		return $val;
	}

	private function copyTab($tab)
	{
	    $tmp = array();
	    foreach($tab as $val)
	    {
	         if(is_array($val))
	             $tmp[] = $this->copy_tab($val);
	         else
	             $tmp[]= $val = $this->protectVar($val);
	    }
	    return $tmp;
	}

$globals = $_POST + $_GET;

/**
 * Fonction de rappel
 * Parfois, on ne peut pas utiliser directement htmlentities.
 */
function clear(&$input, $key)
{
    $input = htmlentities($input);
}

$result = array_walk_recursive($globals, 'clear');

$_ = array_map('mysql_real_escape_string', array_map('htmlentities', array_merge($_GET, $_POST)));