Boas pessoal ![:)]()
É o seguinte, eu estou aqui com um problema um tanto ou quanto estranho xD
Eu uso um script, aliás uso 2 para ajudar a proteção do meu site contra SQL Injection, ataques de XSS, Firewall etc etc
E já os uso há uns bons 3 meses ou 4 e NUNCA me deram problemas, até que agora do nada mesmo começou a censurar as tags HTML que uso quando insiro uma noticia apartir do painel de admin na parte de inserir noticias apartir do site.
Quando envio a noticia para a BD, ele censura as tags e depois no site aparece assim
http://i.gyazo.com/d1f71e01005e30c27c17ec82970e5d3a.png com as tags censuradas...
O estranho é que já uso ele há bastantes tempo como já disse, e só agora é que lhe deu a panca...
O Codigo PHP referente aos ficheiros que uso para proteger o meu site está aqui
E está aqui o outro codigo
Eu já reparei que principalmente no primeiro codigo, ele censura simbolos tais como < e > e etc que fazem parte das tags HTML etc, mas como já disse, isto nunca me deu problemas xD
Só mesmo agora do nada tipo panca...
Será que tem a ver mudanças em versões do PHP ou algo do genero ?
Não sei mesmo xD
Alguem pode ajudar ?

É o seguinte, eu estou aqui com um problema um tanto ou quanto estranho xD
Eu uso um script, aliás uso 2 para ajudar a proteção do meu site contra SQL Injection, ataques de XSS, Firewall etc etc
E já os uso há uns bons 3 meses ou 4 e NUNCA me deram problemas, até que agora do nada mesmo começou a censurar as tags HTML que uso quando insiro uma noticia apartir do painel de admin na parte de inserir noticias apartir do site.
Quando envio a noticia para a BD, ele censura as tags e depois no site aparece assim
http://i.gyazo.com/d1f71e01005e30c27c17ec82970e5d3a.png com as tags censuradas...
O estranho é que já uso ele há bastantes tempo como já disse, e só agora é que lhe deu a panca...
O Codigo PHP referente aos ficheiros que uso para proteger o meu site está aqui
Spoiler
Código :
<?php
function replace($var){
$new_var=str_replace(";","",$var);
$new_var=str_replace("!","",$new_var);
$new_var=str_replace("#","",$new_var);
$new_var=str_replace("%","",$new_var);
$new_var=str_replace("&","",$new_var);
$new_var=str_replace("(","",$new_var);
$new_var=str_replace(")","",$new_var);
$new_var=str_replace("[","",$new_var);
$new_var=str_replace("]","",$new_var);
$new_var=str_replace("{","",$new_var);
$new_var=str_replace("}","",$new_var);
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("insert","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
$new_var=str_replace("--","",$new_var);
$new_var=str_replace("\'\'","",$new_var);
return $new_var;
}
function r_text($var){
$new_var=str_replace(";","",$var);
$new_var=str_replace("!","",$new_var);
$new_var=str_replace("#","",$new_var);
$new_var=str_replace("%","",$new_var);
$new_var=str_replace("&","",$new_var);
$new_var=str_replace("(","",$new_var);
$new_var=str_replace(")","",$new_var);
$new_var=str_replace("{","",$new_var);
$new_var=str_replace("}","",$new_var);
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("insert","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
$new_var=str_replace("--","",$new_var);
$new_var=str_replace("\'\'","",$new_var);
return $new_var;
}
function textarea($var){
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
return $new_var;
}
function unentities($data){
if(trim($data) != ""){
return str_replace(array('<', '>', ''', '"', '&', '\', '%3D', '%26'), array('<', '>', "'", '"', '&', '\\', '=', '&'), $data);
} else return $data;
} // End unentities() --------------
function addentities($data){
if(trim($data) != ""){
$data = htmlentities($data, ENT_QUOTES);
return str_replace('\\', '& #92;', $data);
} else return $data;
}
?>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$time = date("l dS of F Y h:i:s A");
$script = @$_SERVER['PATH_TRANSLATED'];
$fp = fopen ("[WEB]SQL_Injection.txt", "a+");
$sql_inject_1 = array(";","'","%",'"'); #Whoth need replace
$sql_inject_2 = array("", "","","""); #To wont replace
$GET_KEY = array_keys($_GET); #array keys from $_GET
$POST_KEY = array_keys($_POST); #array keys from $_POST
$COOKIE_KEY = array_keys($_COOKIE); #array keys from $_COOKIE
/*begin clear $_GET */
for($i=0;$i<count($GET_KEY);$i++)
{
$real_get[$i] = $_GET[$GET_KEY[$i]];
$_GET[$GET_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_GET[$GET_KEY[$i]]));
if($real_get[$i] != $_GET[$GET_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: GET\r\n");
fwrite ($fp, "Value: $real_get[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_GET */
/*begin clear $_POST */
for($i=0;$i<count($POST_KEY);$i++)
{
$real_post[$i] = $_POST[$POST_KEY[$i]];
$_POST[$POST_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_POST[$POST_KEY[$i]]));
if($real_post[$i] != $_POST[$POST_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: POST\r\n");
fwrite ($fp, "Value: $real_post[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_POST */
/*begin clear $_COOKIE */
for($i=0;$i<count($COOKIE_KEY);$i++)
{
$real_cookie[$i] = $_COOKIE[$COOKIE_KEY[$i]];
$_COOKIE[$COOKIE_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_COOKIE[$COOKIE_KEY[$i]]));
if($real_cookie[$i] != $_COOKIE[$COOKIE_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: COOKIE\r\n");
fwrite ($fp, "Value: $real_cookie[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_COOKIE */
fclose ($fp);
?>
function replace($var){
$new_var=str_replace(";","",$var);
$new_var=str_replace("!","",$new_var);
$new_var=str_replace("#","",$new_var);
$new_var=str_replace("%","",$new_var);
$new_var=str_replace("&","",$new_var);
$new_var=str_replace("(","",$new_var);
$new_var=str_replace(")","",$new_var);
$new_var=str_replace("[","",$new_var);
$new_var=str_replace("]","",$new_var);
$new_var=str_replace("{","",$new_var);
$new_var=str_replace("}","",$new_var);
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("insert","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
$new_var=str_replace("--","",$new_var);
$new_var=str_replace("\'\'","",$new_var);
return $new_var;
}
function r_text($var){
$new_var=str_replace(";","",$var);
$new_var=str_replace("!","",$new_var);
$new_var=str_replace("#","",$new_var);
$new_var=str_replace("%","",$new_var);
$new_var=str_replace("&","",$new_var);
$new_var=str_replace("(","",$new_var);
$new_var=str_replace(")","",$new_var);
$new_var=str_replace("{","",$new_var);
$new_var=str_replace("}","",$new_var);
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("insert","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
$new_var=str_replace("--","",$new_var);
$new_var=str_replace("\'\'","",$new_var);
return $new_var;
}
function textarea($var){
$new_var=str_replace("DROP","",$new_var);
$new_var=str_replace("INSERT","",$new_var);
$new_var=str_replace("ALTER","",$new_var);
$new_var=str_replace("SHUTDOWN","",$new_var);
$new_var=str_replace("UPDATE","",$new_var);
$new_var=str_replace("update","",$new_var);
$new_var=str_replace("drop","",$new_var);
$new_var=str_replace("alter","",$new_var);
$new_var=str_replace("shutdown","",$new_var);
return $new_var;
}
function unentities($data){
if(trim($data) != ""){
return str_replace(array('<', '>', ''', '"', '&', '\', '%3D', '%26'), array('<', '>', "'", '"', '&', '\\', '=', '&'), $data);
} else return $data;
} // End unentities() --------------
function addentities($data){
if(trim($data) != ""){
$data = htmlentities($data, ENT_QUOTES);
return str_replace('\\', '& #92;', $data);
} else return $data;
}
?>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$time = date("l dS of F Y h:i:s A");
$script = @$_SERVER['PATH_TRANSLATED'];
$fp = fopen ("[WEB]SQL_Injection.txt", "a+");
$sql_inject_1 = array(";","'","%",'"'); #Whoth need replace
$sql_inject_2 = array("", "","","""); #To wont replace
$GET_KEY = array_keys($_GET); #array keys from $_GET
$POST_KEY = array_keys($_POST); #array keys from $_POST
$COOKIE_KEY = array_keys($_COOKIE); #array keys from $_COOKIE
/*begin clear $_GET */
for($i=0;$i<count($GET_KEY);$i++)
{
$real_get[$i] = $_GET[$GET_KEY[$i]];
$_GET[$GET_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_GET[$GET_KEY[$i]]));
if($real_get[$i] != $_GET[$GET_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: GET\r\n");
fwrite ($fp, "Value: $real_get[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_GET */
/*begin clear $_POST */
for($i=0;$i<count($POST_KEY);$i++)
{
$real_post[$i] = $_POST[$POST_KEY[$i]];
$_POST[$POST_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_POST[$POST_KEY[$i]]));
if($real_post[$i] != $_POST[$POST_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: POST\r\n");
fwrite ($fp, "Value: $real_post[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_POST */
/*begin clear $_COOKIE */
for($i=0;$i<count($COOKIE_KEY);$i++)
{
$real_cookie[$i] = $_COOKIE[$COOKIE_KEY[$i]];
$_COOKIE[$COOKIE_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_COOKIE[$COOKIE_KEY[$i]]));
if($real_cookie[$i] != $_COOKIE[$COOKIE_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: COOKIE\r\n");
fwrite ($fp, "Value: $real_cookie[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_COOKIE */
fclose ($fp);
?>
E está aqui o outro codigo
Spoiler
Código :
Código :
<?php
function madSafety($string) {
$string = stripslashes($string);
$string = strip_tags($string);
$string = mysql_real_escape_string($string);
return $string;
}
?>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$time = date("l dS of F Y h:i:s A");
$fp = fopen ("[WEB]SQL_Injection.txt", "a+");
$sql_inject_1 = array(";","'","%",'"'); #Whoth need replace
$sql_inject_2 = array("", "","","""); #To wont replace
$GET_KEY = array_keys($_GET); #array keys from $_GET
$POST_KEY = array_keys($_POST); #array keys from $_POST
$COOKIE_KEY = array_keys($_COOKIE); #array keys from $_COOKIE
/*begin clear $_GET */
for($i=0;$i<count($GET_KEY);$i++)
{
$real_get[$i] = $_GET[$GET_KEY[$i]];
$_GET[$GET_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_GET[$GET_KEY[$i]]));
if($real_get[$i] != $_GET[$GET_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: GET\r\n");
fwrite ($fp, "Value: $real_get[$i]\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_GET */
/*begin clear $_POST */
for($i=0;$i<count($POST_KEY);$i++)
{
$real_post[$i] = $_POST[$POST_KEY[$i]];
$_POST[$POST_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_POST[$POST_KEY[$i]]));
if($real_post[$i] != $_POST[$POST_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: POST\r\n");
fwrite ($fp, "Value: $real_post[$i]\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_POST */
/*begin clear $_COOKIE */
for($i=0;$i<count($COOKIE_KEY);$i++)
{
$real_cookie[$i] = $_COOKIE[$COOKIE_KEY[$i]];
$_COOKIE[$COOKIE_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_COOKIE[$COOKIE_KEY[$i]]));
if($real_cookie[$i] != $_COOKIE[$COOKIE_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: COOKIE\r\n");
fwrite ($fp, "Value: $real_cookie[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_COOKIE */
fclose ($fp);
?>
<?PHP
function anti_injection( $user, $pass ) {
$banlist = array ( "insert", "select", "update", "delete", "distinct", "having", "truncate", "replace",
"handler", "like", " as ", "or ", "procedure", "limit", "order by", "group by", "asc", "desc"
);
if ( EREGI ( "[a-zA-Z0-9]+", $user ) ) {
$user = TRIM ( STR_REPLACE ( $banlist, '', strtolower ( $user ) ) );
} else {$user = NULL;
}
if ( EREGI ( "[a-zA-Z0-9]+", $pass ) ) {
$pass = TRIM ( STR_REPLACE ( $banlist, '', strtolower ( $userpass ) ) );
} else {
$pass = NULL;
}
$array = array ( 'user' => $user, 'pass' => $userpass );
if ( in_array ( NULL, $array ) ) {
die ( 'Invalid use of login and/or password. Please use a normal method.' );
} else {
return $array;
}
}
?>
<?php
function mysql_safe($query,$params=false) {
if ($params) {
foreach ($params as &$v) { $v = mysql_real_escape_string($v); }
$sql_query = vsprintf( str_replace("?","'%s'",$query), $params );
$sql_query = mysql_query($sql_query);
} else {
$sql_query = mysql_query($query);
}
return ($sql_query);
}
?>
<?php
class secure{ function secureSuperGlobalGET($key){
$_GET[$key] = str_ireplace("script", "blocked", $_GET[$key]);
$_GET[$key] = strip_tags($_GET[$key]);
return $_GET[$key];
}
function secureSuperGlobalPOST($key){
$_POST[$key] = str_ireplace("script", "blocked", $_POST[$key]);
$_POST[$key] = strip_tags($_POST[$key]);
return $_POST[$key];
}
function secureVar($key){
$key = str_ireplace("script", "blocked", $key);
$key = strip_tags($key);
return $key;
}
}
?>
<!-- Fim da proteção contra SQL Injection -->
<!-----------------------------------------------------------------------!>
<!-- Inicio Cookie Protect -->
<?php
foreach ($_COOKIE as $key => $value) {
if(get_magic_quotes_gpc()) $_COOKIE[$key]=stripslashes($value);
$_COOKIE[$key] = mysql_real_escape_string($value);
}
?>
<!-- Fim de Cookie Protect -->
<!-----------------------------------------------------------------------!>
<!-- Inicio de proteção contra ataques XSS -->
<?php
/**
* Proteger contra ataques XSS
* @param type string $str - sequência de XSS a ser protegido
* @param type string $allowable_tags - tags que não vai eliminar, tais <b>
*/
function strip_xss($str,$allowable_tags=false){
//daca sa setat tag care sa nu fie eliminat
if(!$allowable_tags){
//facem strip_tags fara a elimina tagul(rile) dorit
$rez = strip_tags($str,$allowable_tags);
}
//altfel
else{
//facem strip_tags
$rez = strip_tags($str);
}
//daca se introduce javascript:alert() in input
if(stripos($rez, "javascript:") !== false) {
//eliminam javascript:
$result = str_replace("javascript:","", htmlentities($rez, ENT_QUOTES));
}
//altfel
else {
//tranformama in entitati html, protectia este pusa pentru " onchange="alert(document.cookie); etc
$result = htmlentities($rez, ENT_QUOTES);
}
return $result;
}
?>
<!-- Fim de proteção contra ataques XSS -->
<!-----------------------------------------------------------------------!>
<!-- Inicio de FIREWALL -->
function madSafety($string) {
$string = stripslashes($string);
$string = strip_tags($string);
$string = mysql_real_escape_string($string);
return $string;
}
?>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$time = date("l dS of F Y h:i:s A");
$fp = fopen ("[WEB]SQL_Injection.txt", "a+");
$sql_inject_1 = array(";","'","%",'"'); #Whoth need replace
$sql_inject_2 = array("", "","","""); #To wont replace
$GET_KEY = array_keys($_GET); #array keys from $_GET
$POST_KEY = array_keys($_POST); #array keys from $_POST
$COOKIE_KEY = array_keys($_COOKIE); #array keys from $_COOKIE
/*begin clear $_GET */
for($i=0;$i<count($GET_KEY);$i++)
{
$real_get[$i] = $_GET[$GET_KEY[$i]];
$_GET[$GET_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_GET[$GET_KEY[$i]]));
if($real_get[$i] != $_GET[$GET_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: GET\r\n");
fwrite ($fp, "Value: $real_get[$i]\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_GET */
/*begin clear $_POST */
for($i=0;$i<count($POST_KEY);$i++)
{
$real_post[$i] = $_POST[$POST_KEY[$i]];
$_POST[$POST_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_POST[$POST_KEY[$i]]));
if($real_post[$i] != $_POST[$POST_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: POST\r\n");
fwrite ($fp, "Value: $real_post[$i]\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_POST */
/*begin clear $_COOKIE */
for($i=0;$i<count($COOKIE_KEY);$i++)
{
$real_cookie[$i] = $_COOKIE[$COOKIE_KEY[$i]];
$_COOKIE[$COOKIE_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_COOKIE[$COOKIE_KEY[$i]]));
if($real_cookie[$i] != $_COOKIE[$COOKIE_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: COOKIE\r\n");
fwrite ($fp, "Value: $real_cookie[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_COOKIE */
fclose ($fp);
?>
<?PHP
function anti_injection( $user, $pass ) {
$banlist = array ( "insert", "select", "update", "delete", "distinct", "having", "truncate", "replace",
"handler", "like", " as ", "or ", "procedure", "limit", "order by", "group by", "asc", "desc"
);
if ( EREGI ( "[a-zA-Z0-9]+", $user ) ) {
$user = TRIM ( STR_REPLACE ( $banlist, '', strtolower ( $user ) ) );
} else {$user = NULL;
}
if ( EREGI ( "[a-zA-Z0-9]+", $pass ) ) {
$pass = TRIM ( STR_REPLACE ( $banlist, '', strtolower ( $userpass ) ) );
} else {
$pass = NULL;
}
$array = array ( 'user' => $user, 'pass' => $userpass );
if ( in_array ( NULL, $array ) ) {
die ( 'Invalid use of login and/or password. Please use a normal method.' );
} else {
return $array;
}
}
?>
<?php
function mysql_safe($query,$params=false) {
if ($params) {
foreach ($params as &$v) { $v = mysql_real_escape_string($v); }
$sql_query = vsprintf( str_replace("?","'%s'",$query), $params );
$sql_query = mysql_query($sql_query);
} else {
$sql_query = mysql_query($query);
}
return ($sql_query);
}
?>
<?php
class secure{ function secureSuperGlobalGET($key){
$_GET[$key] = str_ireplace("script", "blocked", $_GET[$key]);
$_GET[$key] = strip_tags($_GET[$key]);
return $_GET[$key];
}
function secureSuperGlobalPOST($key){
$_POST[$key] = str_ireplace("script", "blocked", $_POST[$key]);
$_POST[$key] = strip_tags($_POST[$key]);
return $_POST[$key];
}
function secureVar($key){
$key = str_ireplace("script", "blocked", $key);
$key = strip_tags($key);
return $key;
}
}
?>
<!-- Fim da proteção contra SQL Injection -->
<!-----------------------------------------------------------------------!>
<!-- Inicio Cookie Protect -->
<?php
foreach ($_COOKIE as $key => $value) {
if(get_magic_quotes_gpc()) $_COOKIE[$key]=stripslashes($value);
$_COOKIE[$key] = mysql_real_escape_string($value);
}
?>
<!-- Fim de Cookie Protect -->
<!-----------------------------------------------------------------------!>
<!-- Inicio de proteção contra ataques XSS -->
<?php
/**
* Proteger contra ataques XSS
* @param type string $str - sequência de XSS a ser protegido
* @param type string $allowable_tags - tags que não vai eliminar, tais <b>
*/
function strip_xss($str,$allowable_tags=false){
//daca sa setat tag care sa nu fie eliminat
if(!$allowable_tags){
//facem strip_tags fara a elimina tagul(rile) dorit
$rez = strip_tags($str,$allowable_tags);
}
//altfel
else{
//facem strip_tags
$rez = strip_tags($str);
}
//daca se introduce javascript:alert() in input
if(stripos($rez, "javascript:") !== false) {
//eliminam javascript:
$result = str_replace("javascript:","", htmlentities($rez, ENT_QUOTES));
}
//altfel
else {
//tranformama in entitati html, protectia este pusa pentru " onchange="alert(document.cookie); etc
$result = htmlentities($rez, ENT_QUOTES);
}
return $result;
}
?>
<!-- Fim de proteção contra ataques XSS -->
<!-----------------------------------------------------------------------!>
<!-- Inicio de FIREWALL -->
Eu já reparei que principalmente no primeiro codigo, ele censura simbolos tais como < e > e etc que fazem parte das tags HTML etc, mas como já disse, isto nunca me deu problemas xD
Só mesmo agora do nada tipo panca...
Será que tem a ver mudanças em versões do PHP ou algo do genero ?
Não sei mesmo xD
Alguem pode ajudar ?
