diff options
Diffstat (limited to 'includes/secure.php')
| -rwxr-xr-x | includes/secure.php | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/includes/secure.php b/includes/secure.php new file mode 100755 index 00000000..d6b5c512 --- /dev/null +++ b/includes/secure.php @@ -0,0 +1,41 @@ +<?php +//soll dein funktion entahlten die alle übergebenen parameter überprüft +//'`'" + +if( $DEBUG) + echo "secure.php START<br>\n"; + +foreach ($_GET as $k => $v) +{ +// $v = htmlspecialchars($v, ENT_QUOTES); +// $v = mysql_escape_string($v); + $v = htmlentities($v, ENT_QUOTES); + if (preg_match('/([\'"`\'])/', $v, $match)) + { + print "sorry get has illegal char '$match[1]'"; + exit; + } + $_GET[$k] = $v; + + if( $DEBUG) + echo "GET $k=\"$v\"<br>"; +} + +foreach ($_POST as $k => $v) +{ +// $v = htmlspecialchars($v, ENT_QUOTES); +// $v = mysql_escape_string($v); + $v = htmlentities($v, ENT_QUOTES); + if (preg_match('/([\'"`\'])/', $v, $match)) { + print "sorry post has illegal char '$match[1]'"; + exit; + } + $_POST[$k] = $v; + + if( $DEBUG) + echo "POST $k=\"$v\"<br>"; +} +if( $DEBUG) + echo "secure.php END<br>\n"; + +?> |