Sql İnjection Açıkları / Bypass Engelleme

PHP:
<?php

$ourLogin = "admin";
$ourPassword = "tht";

session_start();

if ($_SESSION['login']!=$ourLogin && $_SESSION['password']!=$ourPassword) { 


if ($_POST['login']==$ourLogin && $_POST['password']==$ourPassword) {


$_SESSION['login'] = $_POST['login'];
$_SESSION['password'] = $_POST['password'];
header("********: index.php");


}
else {


echo "
<form action=index.php method=post>

K. Adi :<br>
<input type=text name=login value=''><br>
Gizlilik :<br>
<input type=password name=password value=''><br>

<input type=submit value=' Tamam '>


</form>
";

exit;

}

PHP:

function clearMethod($mVar){
    if(is_array($mVar)){
        foreach($mVar as $gVal => $gVar){
            if(!is_array($gVar)){
                    $mVar[$gVal] = htmlspecialchars(strip_tags(urldecode(mysql_escape_string(addslashes(stripslashes(stripslashes(trim(htmlspecialchars_decode($gVar)))))))));  // -> Dizi olmadığını fark edip temizledik.
            }else{
                    $mVar[$gVal] = clearMethod($gVar);
            }
        }
    }else{
        $mVar = htmlspecialchars(strip_tags(urldecode(mysql_escape_string(addslashes(stripslashes(stripslashes(trim(htmlspecialchars_decode($mVar))))))))); // -> Dizi olmadığını fark edip temizledik.
    }
    return $mVar;
    

}

// Kullanım

$_GET = clearMethod($_GET); // -> GET verilerini temizledik.
$_POST = clearMethod($_POST); // -> POST verilerini temizledik.
$_SESSION = clearMethod($_SESSION); // -> SESSION verilerini temizledik.
$_COOKIE = clearMethod($_COOKIE); // -> COOKIE verilerini temizledik.
?>

PHP:

if(!function_exists('stripos')) {

function stripos_clone($haystack, $needle, $offset=0) {
    return strpos(strtoupper($haystack), strtoupper($needle), $offset);
}

} else {

function stripos_clone($haystack, $needle, $offset=0) {
    return stripos($haystack, $needle, $offset=0);
}

}

if(isset($_SERVER['QUERY_STRING'])) {

$queryString = strtolower($_SERVER['QUERY_STRING']);

if (stripos_clone($queryString,'%select%20') OR stripos_clone($queryString,'%20union%20') OR stripos_clone($queryString,'union/*') OR stripos_clone($queryString,'c2nyaxb0') OR stripos_clone($queryString,'+union+') OR stripos_clone($queryString,'http://') OR stripos_clone($queryString,'https://') OR (stripos_clone($queryString,'cmd=') AND !stripos_clone($queryString,'&cmd')) OR (stripos_clone($queryString,'exec') AND !stripos_clone($queryString,'execu')) OR stripos_clone($queryString,'union') OR stripos_clone($queryString,'concat') OR stripos_clone($queryString,'ftp://')) {
      
echo base64_decode("c2lrdGlyZ2l0IGFtaW5hIGtvZHVtdSBsYW1lciBpYm5lc2k=");
exit;

}
}