//This prevents SQL Code injection / XSS Attacks.

function replace_meta_chars($string){
return @eregi_replace("([*])|([|])|([;]|([`])","",$string);
}

while(list($keyx,$valuex) = each($_REQUEST)){
if(eregi("([*])|([|])|([;])",$valuex)){
mail("camilo (at) cancun (dot) com","Hack Alert","There's been a SQL Injection hacking attempt. $HTTP_REFERRER $REMOTE_ADDR","FROM:core (at) cancun (dot) com,BCC:bernhardx (at) cancun (dot) com");
}
}

reset ($_REQUEST);
while(list($keyx,$valuex) = each($_REQUEST)){
${$keyx} = replace_meta_chars($valuex);
echo "$keyx $valuex
";
}
//end anti SQL XSS script.

Note: Initially i used the escapeshellcmd() function, but we discovered it was messing with our e-commerce site, as it nukes EVERY metacharacter, included some that are used in credit card transactions; so i had to develop a little function that only nukes what i tell it to.

|

|