note 99494 deleted from function.eregi by danbrown
| From: | danbrown@php.net | Date: | Fri, 20 Aug 2010 13:21:35 +0000 |
| Subject: | note 99494 deleted from function.eregi by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-171884@lists.php.net to get a copy of this message | ||
Note Submitter: gratcypalma at gmail dot com
----
<?php
/*
just small additional for "prevent possible any XSS attack and others via $_GET."
and its also works to for $_REQUEST, $_POST, and $_COOCKIE.
Example $_GET url: http://example.com/?link=page or http://example.com/?link=page&id=1
example to use:
$url = $_GET[url];
$url = GetVar($url);
here my simply code.
*/
function GetVar($get) {
if ($get) {
$banwords = array ("'", ",", ";", "--",
"\"", "%", "+","<",">"); // bad words
$get = strip_tags($get);
if (!ereg("^[-a-zA-Z0-9_=\?]{0,50}$", $get)) { // you ca
//echo $get;
$get = str_replace ( $banwords, '', $get); // replace badwords to null
//var_dump($get);
//echo $get;
}
return $get;
}
else {
return false;
}
}
// its also works
$url = $_GET[url];
$url = GetVar($url);
// or
$link = $_GET[link];
$link = GetVar($link);
?>