hi onasre.

I also think it's an interesting idea.

But the method of "black listing" can protect the site from only script kiddies or worms.
It never be a high hurdle for good-handed-crackers.

I believe DBLayer-Anti-SQL-Injection is a ultimate method protecting SQL Injection.

Now, I just want all core developpers adopt my overridable databasefactory.php