string sanitization even for their own new actions

The used syntax was invalid in PHP < 3.4 and seemed to be wrong logical
as well.

Template authors now can use tpl_sidebar() to include the sidebar.
Sidebars can be defined in subnamespaces as well

\w could match multibyte chars depending on system setup

crypt seems to behave different on different systems when the salt
is empty.

This allows to treat empty parameters as default

This new wrapper ensures types are correct and accessed parameters are
actually set (with custom default fallbacks).

The wrapper is available in the global $INPUT variable. It accesses
$_REQUEST by default. If POST or GET is required, the post and get
members can be used:

$INPUT->int('foo',false); // access $_REQUEST['foo'], default false
$INPUT->post->int('foo'); // access $_POST['foo'], default 0
$INPUT->get->int('foo'); // access $_GET['foo'], default 0

The codebase still needs to be updated to make use of this.