Hello everyone,

I see there's a lot of talk here about how to go about sanitizing data. Could it be as simple as adding this rewrite rule to .htaccess?

RewriteRule ^([\w\-]+)$ index.php?page=$1

To my understanding this will allow only letters, numbers, _ and - in $1, am I right?

If you add to this usage of prepared statements for SQL queries, it should be pretty proof, is that right?

Somehow feels like too easy to be true, am I missing something, any ways to firm it up?