escaping input

Something in my gut tells me this isn't the best way

[sned]

function escape_input(){
if(!get_magic_quotes_gpc()){
foreach($_POST as $id=>$value){
$_POST[$id] = mysql_real_escape_string($value);
}
foreach($_GET as $id=>$value){
$_GET[$id] = mysql_real_escape_string($value);
}
}
return true;
}

Can anybody comment on this function? I'm not sure if blanket escapes like this are a good idea or not.

Thanks!
-sned

[ergophobe]

We've had some discussion on the topic in the past. I like to filter user input and then put it somewhere $clean and then use that.

See this thread:
[webmasterworld.com...]