/* syg_sqli_shield (2026-09-08): legacy pages put request values straight into SQL strings. Escape every request value once, right after connecting. */ if (isset($conn) && $conn instanceof mysqli && !defined('SYG_SQLI_SHIELD')) { define('SYG_SQLI_SHIELD', 1); foreach (array('_GET', '_POST', '_REQUEST', '_COOKIE') as $g) { foreach ($GLOBALS[$g] as $k => $v) { if (is_string($v)) { $GLOBALS[$g][$k] = mysqli_real_escape_string($conn, $v); } } } }