PMA\libraries\Sanitize::removeRequestVars PHP Method

    public static function removeRequestVars(&$whitelist)
    {
        // do not check only $_REQUEST because it could have been overwritten
        // and use type casting because the variables could have become
        // strings
        $keys = array_keys(array_merge((array) $_REQUEST, (array) $_GET, (array) $_POST, (array) $_COOKIE));
        foreach ($keys as $key) {
            if (!in_array($key, $whitelist)) {
                unset($_REQUEST[$key], $_GET[$key], $_POST[$key]);
                continue;
            }
            // allowed stuff could be compromised so escape it
            // we require it to be a string
            if (isset($_REQUEST[$key]) && !is_string($_REQUEST[$key])) {
                unset($_REQUEST[$key]);
            }
            if (isset($_POST[$key]) && !is_string($_POST[$key])) {
                unset($_POST[$key]);
            }
            if (isset($_COOKIE[$key]) && !is_string($_COOKIE[$key])) {
                unset($_COOKIE[$key]);
            }
            if (isset($_GET[$key]) && !is_string($_GET[$key])) {
                unset($_GET[$key]);
            }
        }
    }

 /**
  * Test for removeRequestVars
  *
  * @return void
  */
 public function testRemoveRequestVars()
 {
     $_REQUEST['foo'] = 'bar';
     $_REQUEST['allow'] = 'all';
     $_REQUEST['second'] = 1;
     $allow_list = array('allow', 'second');
     Sanitize::removeRequestVars($allow_list);
     $this->assertFalse(isset($_REQUEST['foo']));
     $this->assertFalse(isset($_REQUEST['second']));
     $this->assertTrue(isset($_REQUEST['allow']));
 }