title: Best way to sanitize a multiple choice select list
body: <p>I’m aware of the benefits of using MySQLi and PDO, but nevertheless I’m wondering what the best way to sanitize a multiple choice select list is out of the following options:</p>
  
  <p>Firstly the obvious method using mysql_real_escape_string:</p>
  
  <pre><code>$clean_POST = array();
  $clean_POST = mysql_real_escape_string($_POST['foo']);
  </code></pre>
  
  <p>But is there a risk that a malicious user could send through numerous POST values and manage to block up the server? The replies <a href="https://stackoverflow.com/questions/8719061/php-could-automatically-processing-every-post-variable-be-a-security-issue">here</a> seem to suggest this is a possibility. </p>
  
  <p>This issue could be mitigated by creating a whitelist and iterating over it checking for exact matches in the POST:</p>
  
  <pre><code>$_POST['foo'] = array('a', 'b');
  $whitelist = array(‘a’, 'b', 'c', 'd');
  $clean_POST = array();
  
  if (isset($_POST['foo']))
      {
      foreach ($whitelist as $value)
          {
          if (in_array($value, $_POST['foo']))
              {
              $clean_POST[] = $value;
              }
          }
      }
  </code></pre>
  
  <p>But compared to the mysql-real-escape-string method is there likely to be a significant processing time disadvantage using this approach, particularly where there are numerous fields which need to be processed concurrently?</p>
  
  <p>Could one method be regarded as superior considering both security and performance?</p>