Is XSS and SQL protection correct?

Question

PHP

Each time, when adding records to the database, I had to check it for SQL injection. And on XSS to do constantly.
Decided to make a simple method. Insert this code at the very beginning of the whole
ZY . I left comments so as not to delve into:

function saveArray($arr){ // Функция для защиты от XSS и SQL
  $r = array(); // Создать массив для возврата

  foreach ($arr as $k => $v){ // Для каждого элемента в массиве для фильрации
    if( strstr($k, 'no-save') ) // Если у ключа массива есть слово 'no-save' 
      continue; // перейти к следующему
    if( $v == "" ){ // Если пустое значение
       $r[$k] = false; // то значение равен false
       continue; // К следующему
    }
    if( ctype_digit($v) ){ // Если все символы в строке - цифра
      $r[$k] = (int) $v; // перевести в тип int
      continue; // К следующему
    }
    if( is_array($v) ){ // Если это массив
      $r[$k] = saveArray($v); // провести через функцию
      continue; // К следующему
    }
    $arr[$k] = htmlspecialchars($v); // Иначе убрать все HTML символы
  }

  return $r; // Вернуть массив
}

$_GET = saveArray($_GET); // Фильтрация $_POST
$_POST = saveArray($_POST); // Фильтрация $_GET

Can this be considered "correct" and used in real projects?
Or are there still disadvantages, which is why it is better not to do this?

Answer 1

earlier in PHP this piece of "uselessness" was out of the box, it was called magic quotes.
1) prepared statements saves from SQL injections
2) XSS must be filtered when information is displayed and not when it is entered, because there is still a chance to miss something.

Answer 2

// If all characters in the string are digits
// convert to int type
, thus it is possible to damage strings of digits with leading zeros

Answer 3

Mass checks are evil. There is always the possibility of missing something.
Learn filter_var, do htmlspecialchars exclusively on output; use exclusively Prepared statements.
You must always specify the rules for validating incoming data manually, then you will mean that you have applied the necessary filter.
ctype_digits doesn't fit at all.
I've been using $var=abs(intval($var)); as a shortcut for a long time.
The output is a positive number or zero. Works with concrete.
With minor changes, you can do it with abs(floatvar(($var));