<?php   
 
function insertMysql($str)    
{   
    if(get_magic_quotes_gpc())return $str;   
  
    //'--这里添加对应的转义规则   
    $arr =array('\\', '\'');   
    $patt=array('\\\\','\\\'');   
    return str_replace($arr,$patt,$str);   
}   

$str = insertMysql($str);

//'-------4
$_GET = array_map('insertMysql', $_GET);   
$_POST = array_map('insertMysql', $_POST);   
$_SERVER = array_map('insertMysql', $_SERVER);   
  
//'-------5   
$_GET = array_walk_recursive($_GET, 'insertMysql')   
$_POST = array_walk_recursive($_POST , 'insertMysql');   
$_SERVER = array_walk_recursive($_SERVER , 'insertMysql');   
?>

$queryitems = sprintf(
    "SELECT itm.* FROM wutao.item as itm, wutao.category as cate where cate.itemid=itm.itemid and cate.category='%s'",
    addslashes($_GET['category'])
);