public static function removeRequestVars(&$whitelist)
{
// do not check only $_REQUEST because it could have been overwritten
// and use type casting because the variables could have become
// strings
$keys = array_keys(array_merge((array) $_REQUEST, (array) $_GET, (array) $_POST, (array) $_COOKIE));
foreach ($keys as $key) {
if (!in_array($key, $whitelist)) {
unset($_REQUEST[$key], $_GET[$key], $_POST[$key]);
continue;
}
// allowed stuff could be compromised so escape it
// we require it to be a string
if (isset($_REQUEST[$key]) && !is_string($_REQUEST[$key])) {
unset($_REQUEST[$key]);
}
if (isset($_POST[$key]) && !is_string($_POST[$key])) {
unset($_POST[$key]);
}
if (isset($_COOKIE[$key]) && !is_string($_COOKIE[$key])) {
unset($_COOKIE[$key]);
}
if (isset($_GET[$key]) && !is_string($_GET[$key])) {
unset($_GET[$key]);
}
}
}