diabolik
Membru
Data inscrierii: 13/Feb/2009
Mesaje: 70
Localitate: Motru
|
 Trimis: 15/02/2009 12:59 Titlul subiectului: Anti sql injection |
 |
|
Cod:
| Cod: | //This prevents SQL Code injection / XSS Attacks.
function replace_meta_chars($string){
return @eregi_replace("([*])|([|])|([;]|([`])","",$string);
}
while(list($keyx,$valuex) = each($_REQUEST)){
if(eregi("([*])|([|])|([;])",$valuex)){
mail("camilo@cancun.com","Hack Alert","There's been a SQL Injection hacking attempt. $HTTP_REFERRER $REMOTE_ADDR","FROM:core@cancun.com,BCC:bernhardx@cancun.com");
}
}
reset ($_REQUEST);
while(list($keyx,$valuex) = each($_REQUEST)){
${$keyx} = replace_meta_chars($valuex);
echo "$keyx $valuex
";
}
//end anti SQL XSS script.
Note: Initially i used the escapeshellcmd() function, but we discovered it was messing with our e-commerce site, as it nukes EVERY metacharacter, included some that are used in credit card transactions; so i had to develop a little function that only nukes what i tell it to. :)
|
_________________
To hack is a dream , To be hacked it's a nightmare ^_^
This is 10 % luck, 20 % skill
15 % concentrated power of will
5 % pleasure, 50 % pain
And 100 % reason to remember the name |
|
