firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

post 등에 mysql_real_escape_string 적용하는 코드 수정

Browse Source
This commit is contained in:
chicpro
2014-02-20 11:29:19 +09:00
parent 7bd383b7cf
commit bc1cfad1c2
20 changed files with 76 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
adm/board_copy_update.php
View File

@ -4,8 +4,8 @@ include_once('./_common.php');
auth_check($auth[$sub_menu], 'w');
$target_table = escape_trim($_POST['target_table']);
$target_subject = escape_trim($_POST['target_subject']);
$target_table = trim($_POST['target_table']);
$target_subject = trim($_POST['target_subject']);
if (!preg_match('/[A-Za-z0-9_]{1,20}/', $target_table)) {
alert('게시판 TABLE명은 공백없이 영문자, 숫자, _ 만 사용 가능합니다. (20자 이내)');

2
adm/board_list_update.php
View File

@ -62,7 +62,7 @@ if ($_POST['act_button'] == "선택수정") {
$k = $_POST['chk'][$i];
// include 전에 $bo_table 값을 반드시 넘겨야 함
$tmp_bo_table = escape_trim($_POST['board_table'][$k]);
$tmp_bo_table = trim($_POST['board_table'][$k]);
include ('./board_delete.inc.php');
}

2
adm/member_form_update.php
View File

@ -10,7 +10,7 @@ auth_check($auth[$sub_menu], 'w');
check_token();
$mb_id = escape_trim($_POST['mb_id']);
$mb_id = trim($_POST['mb_id']);
// 휴대폰번호 체크
$mb_hp = $_POST['mb_hp'];

4
adm/visit_search.php
View File

@ -9,8 +9,8 @@ $g5['title'] = '접속자검색';
include_once('./admin.head.php');
include_once(G5_PLUGIN_PATH.'/jquery-ui/datepicker.php');
$search_word = escape_trim($_GET['search_word']);
$search_sort = escape_trim($_GET['search_sort']);
$search_word = trim($_GET['search_word']);
$search_sort = trim($_GET['search_sort']);
$colspan = 5;
$qstr = 'search_word='.$search_word.'&search_sort='.$search_sort; //페이징 처리관련 변수

6
bbs/ajax.autosave.php
View File

@ -3,9 +3,9 @@ include_once('./_common.php');
if (!$is_member) die('0');
$uid = escape_trim($_REQUEST['uid']);
$subject = escape_trim(stripslashes($_REQUEST['subject']));
$content = escape_trim(stripslashes($_REQUEST['content']));
$uid = trim($_REQUEST['uid']);
$subject = trim(stripslashes($_REQUEST['subject']));
$content = trim(stripslashes($_REQUEST['content']));
if ($subject && $content) {
$sql = " select count(*) as cnt from {$g5['autosave_table']} where mb_id = '{$member['mb_id']}' and as_subject = '$subject' and as_content = '$content' ";

4
bbs/ajax.mb_email.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_email = escape_trim($_POST['reg_mb_email']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_email = trim($_POST['reg_mb_email']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_email($mb_email)) die($msg);
if ($msg = valid_mb_email($mb_email)) die($msg);

4
bbs/ajax.mb_hp.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_hp = escape_trim($_POST['reg_mb_hp']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_hp = trim($_POST['reg_mb_hp']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = valid_mb_hp($mb_hp)) die($msg);
if ($msg = exist_mb_hp($mb_hp, $mb_id)) die($msg);

2
bbs/ajax.mb_id.php
View File

@ -2,7 +2,7 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_id($mb_id)) die($msg);
if ($msg = valid_mb_id($mb_id)) die($msg);

4
bbs/ajax.mb_nick.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_nick = escape_trim($_POST['reg_mb_nick']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_nick = trim($_POST['reg_mb_nick']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_nick($mb_nick)) die($msg);
if ($msg = valid_mb_nick($mb_nick)) die($msg);

2
bbs/ajax.mb_recommend.php
View File

@ -2,7 +2,7 @@
include_once("./_common.php");
include_once(G5_LIB_PATH."/register.lib.php");
$mb_recommend = escape_trim($_POST["reg_mb_recommend"]);
$mb_recommend = trim($_POST["reg_mb_recommend"]);
if ($msg = valid_mb_id($mb_recommend)) {
die("추천인의 아이디는 영문자, 숫자, _ 만 입력하세요.");

6
bbs/login_check.php
View File

@ -3,10 +3,10 @@ include_once('./_common.php');
$g5['title'] = "로그인 검사";
$mb_id = escape_trim($_POST['mb_id']);
$mb_password = escape_trim($_POST['mb_password']);
$mb_id = trim($_POST['mb_id']);
$mb_password = trim($_POST['mb_password']);
if (!trim($mb_id) || !trim($mb_password))
if (!$mb_id || !$mb_password)
alert('회원아이디나 비밀번호가 공백이면 안됩니다.');
$mb = get_member($mb_id);

2
bbs/password_lost2.php
View File

@ -11,7 +11,7 @@ if (!chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
}
$email = escape_trim($_POST['mb_email']);
$email = trim($_POST['mb_email']);
if (!$email)
alert_close('메일주소 오류입니다.');

2
bbs/qawrite_update.php
View File

@ -52,7 +52,7 @@ for ($i=1; $i<=5; $i++) {
$var = "qa_$i";
$$var = "";
if (isset($_POST['qa_'.$i]) && $_POST['qa_'.$i]) {
$$var = escape_trim($_POST['qa_'.$i]);
$$var = trim($_POST['qa_'.$i]);
}
}

4
bbs/register_email_update.php
View File

@ -3,8 +3,8 @@ include_once('./_common.php');
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
include_once(G5_LIB_PATH.'/mailer.lib.php');
$mb_id = escape_trim($_POST['mb_id']);
$mb_email = escape_trim($_POST['mb_email']);
$mb_id = trim($_POST['mb_id']);
$mb_email = trim($_POST['mb_email']);
$sql = " select mb_name, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' and mb_email_certify <> '' ";
$mb = sql_fetch($sql);

64
bbs/register_form_update.php
View File

@ -20,38 +20,38 @@ if (!chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
}
$mb_id = escape_trim($_POST['mb_id']);
$mb_password = escape_trim($_POST['mb_password']);
$mb_password_re = escape_trim($_POST['mb_password_re']);
$mb_name = escape_trim($_POST['mb_name']);
$mb_nick = escape_trim($_POST['mb_nick']);
$mb_email = escape_trim($_POST['mb_email']);
$mb_sex = isset($_POST['mb_sex']) ? escape_trim($_POST['mb_sex']) : "";
$mb_birth = isset($_POST['mb_birth']) ? escape_trim($_POST['mb_birth']) : "";
$mb_homepage = isset($_POST['mb_homepage']) ? escape_trim($_POST['mb_homepage']) : "";
$mb_tel = isset($_POST['mb_tel']) ? escape_trim($_POST['mb_tel']) : "";
$mb_hp = isset($_POST['mb_hp']) ? escape_trim($_POST['mb_hp']) : "";
$mb_zip1 = isset($_POST['mb_zip1']) ? escape_trim($_POST['mb_zip1']) : "";
$mb_zip2 = isset($_POST['mb_zip2']) ? escape_trim($_POST['mb_zip2']) : "";
$mb_addr1 = isset($_POST['mb_addr1']) ? escape_trim($_POST['mb_addr1']) : "";
$mb_addr2 = isset($_POST['mb_addr2']) ? escape_trim($_POST['mb_addr2']) : "";
$mb_addr3 = isset($_POST['mb_addr3']) ? escape_trim($_POST['mb_addr3']) : "";
$mb_addr_jibeon = isset($_POST['mb_addr_jibeon']) ? escape_trim($_POST['mb_addr_jibeon']) : "";
$mb_signature = isset($_POST['mb_signature']) ? escape_trim($_POST['mb_signature']) : "";
$mb_profile = isset($_POST['mb_profile']) ? escape_trim($_POST['mb_profile']) : "";
$mb_recommend = isset($_POST['mb_recommend']) ? escape_trim($_POST['mb_recommend']) : "";
$mb_mailling = isset($_POST['mb_mailling']) ? escape_trim($_POST['mb_mailling']) : "";
$mb_sms = isset($_POST['mb_sms']) ? escape_trim($_POST['mb_sms']) : "";
$mb_1 = isset($_POST['mb_1']) ? escape_trim($_POST['mb_1']) : "";
$mb_2 = isset($_POST['mb_2']) ? escape_trim($_POST['mb_2']) : "";
$mb_3 = isset($_POST['mb_3']) ? escape_trim($_POST['mb_3']) : "";
$mb_4 = isset($_POST['mb_4']) ? escape_trim($_POST['mb_4']) : "";
$mb_5 = isset($_POST['mb_5']) ? escape_trim($_POST['mb_5']) : "";
$mb_6 = isset($_POST['mb_6']) ? escape_trim($_POST['mb_6']) : "";
$mb_7 = isset($_POST['mb_7']) ? escape_trim($_POST['mb_7']) : "";
$mb_8 = isset($_POST['mb_8']) ? escape_trim($_POST['mb_8']) : "";
$mb_9 = isset($_POST['mb_9']) ? escape_trim($_POST['mb_9']) : "";
$mb_10 = isset($_POST['mb_10']) ? escape_trim($_POST['mb_10']) : "";
$mb_id = trim($_POST['mb_id']);
$mb_password = trim($_POST['mb_password']);
$mb_password_re = trim($_POST['mb_password_re']);
$mb_name = trim($_POST['mb_name']);
$mb_nick = trim($_POST['mb_nick']);
$mb_email = trim($_POST['mb_email']);
$mb_sex = isset($_POST['mb_sex']) ? trim($_POST['mb_sex']) : "";
$mb_birth = isset($_POST['mb_birth']) ? trim($_POST['mb_birth']) : "";
$mb_homepage = isset($_POST['mb_homepage']) ? trim($_POST['mb_homepage']) : "";
$mb_tel = isset($_POST['mb_tel']) ? trim($_POST['mb_tel']) : "";
$mb_hp = isset($_POST['mb_hp']) ? trim($_POST['mb_hp']) : "";
$mb_zip1 = isset($_POST['mb_zip1']) ? trim($_POST['mb_zip1']) : "";
$mb_zip2 = isset($_POST['mb_zip2']) ? trim($_POST['mb_zip2']) : "";
$mb_addr1 = isset($_POST['mb_addr1']) ? trim($_POST['mb_addr1']) : "";
$mb_addr2 = isset($_POST['mb_addr2']) ? trim($_POST['mb_addr2']) : "";
$mb_addr3 = isset($_POST['mb_addr3']) ? trim($_POST['mb_addr3']) : "";
$mb_addr_jibeon = isset($_POST['mb_addr_jibeon']) ? trim($_POST['mb_addr_jibeon']) : "";
$mb_signature = isset($_POST['mb_signature']) ? trim($_POST['mb_signature']) : "";
$mb_profile = isset($_POST['mb_profile']) ? trim($_POST['mb_profile']) : "";
$mb_recommend = isset($_POST['mb_recommend']) ? trim($_POST['mb_recommend']) : "";
$mb_mailling = isset($_POST['mb_mailling']) ? trim($_POST['mb_mailling']) : "";
$mb_sms = isset($_POST['mb_sms']) ? trim($_POST['mb_sms']) : "";
$mb_1 = isset($_POST['mb_1']) ? trim($_POST['mb_1']) : "";
$mb_2 = isset($_POST['mb_2']) ? trim($_POST['mb_2']) : "";
$mb_3 = isset($_POST['mb_3']) ? trim($_POST['mb_3']) : "";
$mb_4 = isset($_POST['mb_4']) ? trim($_POST['mb_4']) : "";
$mb_5 = isset($_POST['mb_5']) ? trim($_POST['mb_5']) : "";
$mb_6 = isset($_POST['mb_6']) ? trim($_POST['mb_6']) : "";
$mb_7 = isset($_POST['mb_7']) ? trim($_POST['mb_7']) : "";
$mb_8 = isset($_POST['mb_8']) ? trim($_POST['mb_8']) : "";
$mb_9 = isset($_POST['mb_9']) ? trim($_POST['mb_9']) : "";
$mb_10 = isset($_POST['mb_10']) ? trim($_POST['mb_10']) : "";
if ($w == '' || $w == 'u') {

10
bbs/visit_insert.inc.php
View File

@ -1,8 +1,8 @@
<?php
if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
// 컴퓨터의 아이피와 쿠키에 저장된 아이피가 다르다면 테이블에 반영함
if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
{
set_cookie('ck_visit_ip', $_SERVER['REMOTE_ADDR'], 86400); // 하루동안 저장
@ -22,7 +22,7 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
if ($result) {
$sql = " insert {$g5['visit_sum_table']} ( vs_count, vs_date) values ( 1, '".G5_TIME_YMD."' ) ";
$result = sql_query($sql, FALSE);
// DUPLICATE 오류가 발생한다면 이미 날짜별 행이 생성되었으므로 UPDATE 실행
if (!$result) {
$sql = " update {$g5['visit_sum_table']} set vs_count = vs_count + 1 where vs_date = '".G5_TIME_YMD."' ";
@ -48,13 +48,13 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
$vi_max = $row['cnt'];
// 전체
$sql = " select sum(vs_count) as total from {$g5['visit_sum_table']} ";
$sql = " select sum(vs_count) as total from {$g5['visit_sum_table']} ";
$row = sql_fetch($sql);
$vi_sum = $row['total'];
$visit = '오늘:'.$vi_today.',어제:'.$vi_yesterday.',최대:'.$vi_max.',전체:'.$vi_sum;
// 기본설정 테이블에 방문자수를 기록한 후
// 기본설정 테이블에 방문자수를 기록한 후
// 방문자수 테이블을 읽지 않고 출력한다.
// 쿼리의 수를 상당부분 줄임
sql_query(" update {$g5['config_table']} set cf_visit = '{$visit}' ");

4
bbs/write_comment_update.php
View File

@ -12,10 +12,10 @@ if (substr_count($wr_content, "&#") > 50) {
@include_once($board_skin_path.'/write_comment_update.head.skin.php');
$w = $_POST["w"];
$wr_name = escape_trim($_POST['wr_name']);
$wr_name = trim($_POST['wr_name']);
$wr_email = '';
if (!empty($_POST['wr_email']))
$wr_email = escape_trim($_POST['wr_email']);
$wr_email = trim($_POST['wr_email']);
// 비회원의 경우 이름이 누락되는 경우가 있음
if ($is_guest) {

8
bbs/write_update.php
View File

@ -50,8 +50,8 @@ if (empty($_POST)) {
}
$w = $_POST['w'];
$wr_link1 = escape_trim(strip_tags($_POST['wr_link1']));
$wr_link2 = escape_trim(strip_tags($_POST['wr_link2']));
$wr_link1 = trim(strip_tags($_POST['wr_link1']));
$wr_link2 = trim(strip_tags($_POST['wr_link2']));
$notice_array = explode(",", $board['bo_notice']);
@ -91,7 +91,7 @@ for ($i=1; $i<=10; $i++) {
$var = "wr_$i";
$$var = "";
if (isset($_POST['wr_'.$i]) && $_POST['wr_'.$i]) {
$$var = escape_trim($_POST['wr_'.$i]);
$$var = trim($_POST['wr_'.$i]);
}
}
@ -291,7 +291,7 @@ if ($w == '' || $w == 'r') {
} else {
$mb_id = '';
// 비회원의 경우 이름이 누락되는 경우가 있음
$wr_name = escape_trim($_POST['wr_name']);
$wr_name = trim($_POST['wr_name']);
if (!$wr_name)
alert('이름은 필히 입력하셔야 합니다.');
$wr_password = sql_password($wr_password);

14
common.php
View File

@ -205,7 +205,7 @@ if (isset($_REQUEST['PHPSESSID']) && $_REQUEST['PHPSESSID'] != session_id())
$qstr = '';
if (isset($_REQUEST['sca'])) {
$sca = escape_trim($_REQUEST['sca']);
$sca = trim($_REQUEST['sca']);
if ($sca)
$qstr .= '&amp;sca=' . urlencode($sca);
} else {
@ -213,7 +213,7 @@ if (isset($_REQUEST['sca'])) {
}
if (isset($_REQUEST['sfl'])) {
$sfl = escape_trim($_REQUEST['sfl']);
$sfl = trim($_REQUEST['sfl']);
$sfl = preg_replace("/[\<\>\'\"\%\=\(\)\s]/", "", $sfl);
if ($sfl)
$qstr .= '&amp;sfl=' . urlencode($sfl); // search field (검색 필드)
@ -223,7 +223,7 @@ if (isset($_REQUEST['sfl'])) {
if (isset($_REQUEST['stx'])) { // search text (검색어)
$stx = escape_trim($_REQUEST['stx']);
$stx = trim($_REQUEST['stx']);
if ($stx)
$qstr .= '&amp;stx=' . urlencode($stx);
} else {
@ -231,7 +231,7 @@ if (isset($_REQUEST['stx'])) { // search text (검색어)
}
if (isset($_REQUEST['sst'])) {
$sst = escape_trim($_REQUEST['sst']);
$sst = trim($_REQUEST['sst']);
if ($sst)
$qstr .= '&amp;sst=' . urlencode($sst); // search sort (검색 정렬 필드)
} else {
@ -283,7 +283,7 @@ if (isset($_REQUEST['wr_id'])) {
}
if (isset($_REQUEST['bo_table'])) {
$bo_table = escape_trim($_REQUEST['bo_table']);
$bo_table = trim($_REQUEST['bo_table']);
$bo_table = substr($bo_table, 0, 20);
} else {
$bo_table = '';
@ -291,7 +291,7 @@ if (isset($_REQUEST['bo_table'])) {
// URL ENCODING
if (isset($_REQUEST['url'])) {
$url = escape_trim($_REQUEST['url']);
$url = trim($_REQUEST['url']);
$urlencode = urlencode($url);
} else {
$url = '';
@ -303,7 +303,7 @@ if (isset($_REQUEST['url'])) {
}
if (isset($_REQUEST['gr_id'])) {
$gr_id = escape_trim($_REQUEST['gr_id']);
$gr_id = trim($_REQUEST['gr_id']);
} else {
$gr_id = '';
}

4
lib/common.lib.php
View File

@ -1885,8 +1885,8 @@ function escape_trim($field)
if ($field) {
$str = mysql_real_escape_string(@trim($field));
if(PHP_VERSION < '5.3.0')
$str = stripslashes($str);
//if(PHP_VERSION < '5.3.0')
// $str = stripslashes($str);
return $str;
}