grrrr

[nclemale36]

i thought i had this covered but seems not.

else if($action=="uprof")
{
    addonline(getuid_sid($sid),"Updating Settings","");
    $savat = mysql_real_escape_string($_POST["savat"]);
    $semail = mysql_real_escape_string($_POST["semail"]);
    $ubday = mysql_real_escape_string($_POST["ubday"]);
    $uloc = mysql_real_escape_string($_POST["uloc"]);
    $usig = mysql_real_escape_string($_POST["usig"]);
    $usex = mysql_real_escape_string($_POST["usex"]);
    $ms = mysql_real_escape_string($_POST["ms"]);

/////////////////////

function mysql_real_escape_string($string) 
{
 $badWords = "(delete)|(update)|(union)|(insert)| (drop)|(http)|(--)|(>)|(<)|(&)|(#)"; 
 $string = eregi_replace($badWords, "", $string);

 $string = mysql_real_escape_string($string); 

return $string;
 }
/////////////////////////////

just had some muppet update all my location and emails to this site always gets hacked.

last person that did this was huwad or his mates .

why dont the codes i got in place stop this ? ? ?

[subzero]

block ' , in inputs

[nclemale36]

so add (,) to

$badWords = "(delete)|(update)|(union)|(insert)| (drop)|(http)|(--)|(>)|(<)|(&)|(#)";

???

[opticalpigion]

so add (,) to

$badWords = "(delete)|(update)|(union)|(insert)| (drop)|(http)|(--)|(>)|(<)|(&)|(#)";

???

function clean($str) { 
        $str = @trim($str); 
        if(get_magic_quotes_gpc()) { 
            $str=htmlspecialchars($str);                        
            $str=stripslashes(trim($str)); 
            $search=array("\\","\0","\n","\r","\x1a","'",'"'); 
            $replace=array("\\\\","\\0","\\n","\\r","\Z","\'",'\"'); 
            $str = str_replace($search,$replace,$str); 
        } 
        return mysql_real_escape_string($str); 
    } 

[nclemale36]

do i replace that with my function ? ? ? @ optical. .

[thanatos]

sanitize the query where the browser and ip gets updated.

[CreativityKills]

function sanitize($value, $escape = FALSE)
{
 if(is_array($value) OR is_object($value))
 {
  foreach($value as $k => $v)
  {
   // Handle recursively
   $value[$k] = sanitize($v, (bool) $escape);
  }
 }
 elseif(is_string($value))
 {
   if(get_magic_quotes_gpc())
  {
    $value = stripslashes($value);
  }

  if(strpos($value, "\r") === TRUE)
  {
   $value = str_replace(array("\r\n", "\n"), "\n", $value);
  }

 return ($escape) ? mysql_real_escape_string($value) : $value;
 }
}

$_GET = sanitize($_GET);
$_POST = sanitize($_POST);
$_COOKIE = sanitize($_COOKIE); 

Added after 2 minutes:

and oh i just noticed your function name is a reserved php function, thats stupid.

[nclemale36]

its not really i just put it like that on here so no one else sees my real function

[CreativityKills]

um why? Youre afraid someone will use it remotely? Lol half you folks dont know a thing about php.