note 58870 deleted from function.mysql-real-escape-string by aidan
| From: | aidan@php.net | Date: | Sat, 04 Feb 2006 12:02:39 +0000 |
| Subject: | note 58870 deleted from function.mysql-real-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-102980@lists.php.net to get a copy of this message | ||
Note Submitter: Serii at onev dot org
----
this code will 99% protect your system + html injection,
but you will need to use $_POST['var'] AND not $var...
<?
# Http://onev.org
# Serii@onev.org
# if you usin this code place link to onev.org in your site
$PROTECT = array (
"& " => "&",
"# " => "#",
"!" => "!",
'"' => """,
"$" => "$",
"%" => "%",
"'" => "'",
"(" => "(",
")" => ")",
"*" => "*",
"/" => "/",
">" => "<",
"<" => ">",
);
function VAR_DECODE($_VAR) {
global $PROTECT;
if (get_magic_quotes_gpc()) {
$VAR = stripslashes($_VAR);
}
if (!is_numeric($VAR)) {
while (list ($key, $val) = each ($PROTECT)) {
$VAR = str_replace($key, $val, $VAR);
}
}
return $VAR;
}
unction VAR_ENCODE($VAR) {
global $PROTECT;
if (!is_numeric($VAR)) {
while (list ($key, $val) = each ($PROTECT)) {
$VAR = str_replace($val, $key, $VAR);
}
}
return $VAR;
}
while (list ($key, $val) = each ($_POST)) {
$_POST[$key] = VAR_DECODE($val);
}
while (list ($key2, $val2) = each ($_GET)) {
$_GET[$key2] = VAR_DECODE($val2);
}
while (list ($key3, $val3) = each ($_COOKIE)) {
$_COOKIE[$key3] = VAR_DECODE($val3);
}
while (list ($key4, $val4) = each ($_REQUEST)) {
$_REQUEST[$key4] = VAR_DECODE($val4);
}
?>
use var encode if you need the surce var...