// ********** [ SQL INJECTION FILTER FUNCTION ] ********** //
function sqlInjectionFilet($val)
{

    $find = ["select", "union", "order", "\"", "'", "version", "#", "$"];
    $change = ["", "", "", "", "", "", "", ""];

    return str_replace($find, $change, $val);
}

// ********** [ URL FILTER FUNCTION ] ********** //
function filterUrl($val)
{

    return trim(addslashes(strip_tags(filter_var(rtrim($val, "/"), FILTER_SANITIZE_URL))));
}


// ********** [ GET METHOD ] ********** //
function get($val)
{

    if (isset($_GET[$val])) {

        if (is_array($_GET[$val])) {

            return array_map(
                function ($item) {
                    return sqlInjectionFilet(filterUrl($item));
                }, $_GET[$val]
            );
        } else {

            return sqlInjectionFilet(filterUrl($_GET[$val]));
        }
    }
}

// ********** [ POST METHOD] ********** //
function post($val, $htmlTags = '')
{

    if (isset($_POST[$val])) {

        if ($htmlTags != "") {

            return @htmlspecialchars(trim(addslashes($_POST[$val])));
        } else {

            return @htmlspecialchars(trim(addslashes(strip_tags($_POST[$val]))));
        }
    }
}

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username);
$stmt->execute();

$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);