firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

post 등에 mysql_real_escape_string 적용하는 코드 수정

Browse Source
This commit is contained in:
chicpro
2014-02-20 11:29:19 +09:00
parent 7bd383b7cf
commit bc1cfad1c2
20 changed files with 76 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
bbs/ajax.autosave.php
View File

@ -3,9 +3,9 @@ include_once('./_common.php');
if (!$is_member) die('0');
$uid = escape_trim($_REQUEST['uid']);
$subject = escape_trim(stripslashes($_REQUEST['subject']));
$content = escape_trim(stripslashes($_REQUEST['content']));
$uid = trim($_REQUEST['uid']);
$subject = trim(stripslashes($_REQUEST['subject']));
$content = trim(stripslashes($_REQUEST['content']));
if ($subject && $content) {
$sql = " select count(*) as cnt from {$g5['autosave_table']} where mb_id = '{$member['mb_id']}' and as_subject = '$subject' and as_content = '$content' ";

4
bbs/ajax.mb_email.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_email = escape_trim($_POST['reg_mb_email']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_email = trim($_POST['reg_mb_email']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_email($mb_email)) die($msg);
if ($msg = valid_mb_email($mb_email)) die($msg);

4
bbs/ajax.mb_hp.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_hp = escape_trim($_POST['reg_mb_hp']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_hp = trim($_POST['reg_mb_hp']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = valid_mb_hp($mb_hp)) die($msg);
if ($msg = exist_mb_hp($mb_hp, $mb_id)) die($msg);

2
bbs/ajax.mb_id.php
View File

@ -2,7 +2,7 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_id($mb_id)) die($msg);
if ($msg = valid_mb_id($mb_id)) die($msg);

4
bbs/ajax.mb_nick.php
View File

@ -2,8 +2,8 @@
include_once('./_common.php');
include_once(G5_LIB_PATH.'/register.lib.php');
$mb_nick = escape_trim($_POST['reg_mb_nick']);
$mb_id = escape_trim($_POST['reg_mb_id']);
$mb_nick = trim($_POST['reg_mb_nick']);
$mb_id = trim($_POST['reg_mb_id']);
if ($msg = empty_mb_nick($mb_nick)) die($msg);
if ($msg = valid_mb_nick($mb_nick)) die($msg);

2
bbs/ajax.mb_recommend.php
View File

@ -2,7 +2,7 @@
include_once("./_common.php");
include_once(G5_LIB_PATH."/register.lib.php");
$mb_recommend = escape_trim($_POST["reg_mb_recommend"]);
$mb_recommend = trim($_POST["reg_mb_recommend"]);
if ($msg = valid_mb_id($mb_recommend)) {
die("추천인의 아이디는 영문자, 숫자, _ 만 입력하세요.");

6
bbs/login_check.php
View File

@ -3,10 +3,10 @@ include_once('./_common.php');
$g5['title'] = "로그인 검사";
$mb_id = escape_trim($_POST['mb_id']);
$mb_password = escape_trim($_POST['mb_password']);
$mb_id = trim($_POST['mb_id']);
$mb_password = trim($_POST['mb_password']);
if (!trim($mb_id) || !trim($mb_password))
if (!$mb_id || !$mb_password)
alert('회원아이디나 비밀번호가 공백이면 안됩니다.');
$mb = get_member($mb_id);

2
bbs/password_lost2.php
View File

@ -11,7 +11,7 @@ if (!chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
}
$email = escape_trim($_POST['mb_email']);
$email = trim($_POST['mb_email']);
if (!$email)
alert_close('메일주소 오류입니다.');

2
bbs/qawrite_update.php
View File

@ -52,7 +52,7 @@ for ($i=1; $i<=5; $i++) {
$var = "qa_$i";
$$var = "";
if (isset($_POST['qa_'.$i]) && $_POST['qa_'.$i]) {
$$var = escape_trim($_POST['qa_'.$i]);
$$var = trim($_POST['qa_'.$i]);
}
}

4
bbs/register_email_update.php
View File

@ -3,8 +3,8 @@ include_once('./_common.php');
include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
include_once(G5_LIB_PATH.'/mailer.lib.php');
$mb_id = escape_trim($_POST['mb_id']);
$mb_email = escape_trim($_POST['mb_email']);
$mb_id = trim($_POST['mb_id']);
$mb_email = trim($_POST['mb_email']);
$sql = " select mb_name, mb_datetime from {$g5['member_table']} where mb_id = '{$mb_id}' and mb_email_certify <> '' ";
$mb = sql_fetch($sql);

64
bbs/register_form_update.php
View File

@ -20,38 +20,38 @@ if (!chk_captcha()) {
alert('자동등록방지 숫자가 틀렸습니다.');
}
$mb_id = escape_trim($_POST['mb_id']);
$mb_password = escape_trim($_POST['mb_password']);
$mb_password_re = escape_trim($_POST['mb_password_re']);
$mb_name = escape_trim($_POST['mb_name']);
$mb_nick = escape_trim($_POST['mb_nick']);
$mb_email = escape_trim($_POST['mb_email']);
$mb_sex = isset($_POST['mb_sex']) ? escape_trim($_POST['mb_sex']) : "";
$mb_birth = isset($_POST['mb_birth']) ? escape_trim($_POST['mb_birth']) : "";
$mb_homepage = isset($_POST['mb_homepage']) ? escape_trim($_POST['mb_homepage']) : "";
$mb_tel = isset($_POST['mb_tel']) ? escape_trim($_POST['mb_tel']) : "";
$mb_hp = isset($_POST['mb_hp']) ? escape_trim($_POST['mb_hp']) : "";
$mb_zip1 = isset($_POST['mb_zip1']) ? escape_trim($_POST['mb_zip1']) : "";
$mb_zip2 = isset($_POST['mb_zip2']) ? escape_trim($_POST['mb_zip2']) : "";
$mb_addr1 = isset($_POST['mb_addr1']) ? escape_trim($_POST['mb_addr1']) : "";
$mb_addr2 = isset($_POST['mb_addr2']) ? escape_trim($_POST['mb_addr2']) : "";
$mb_addr3 = isset($_POST['mb_addr3']) ? escape_trim($_POST['mb_addr3']) : "";
$mb_addr_jibeon = isset($_POST['mb_addr_jibeon']) ? escape_trim($_POST['mb_addr_jibeon']) : "";
$mb_signature = isset($_POST['mb_signature']) ? escape_trim($_POST['mb_signature']) : "";
$mb_profile = isset($_POST['mb_profile']) ? escape_trim($_POST['mb_profile']) : "";
$mb_recommend = isset($_POST['mb_recommend']) ? escape_trim($_POST['mb_recommend']) : "";
$mb_mailling = isset($_POST['mb_mailling']) ? escape_trim($_POST['mb_mailling']) : "";
$mb_sms = isset($_POST['mb_sms']) ? escape_trim($_POST['mb_sms']) : "";
$mb_1 = isset($_POST['mb_1']) ? escape_trim($_POST['mb_1']) : "";
$mb_2 = isset($_POST['mb_2']) ? escape_trim($_POST['mb_2']) : "";
$mb_3 = isset($_POST['mb_3']) ? escape_trim($_POST['mb_3']) : "";
$mb_4 = isset($_POST['mb_4']) ? escape_trim($_POST['mb_4']) : "";
$mb_5 = isset($_POST['mb_5']) ? escape_trim($_POST['mb_5']) : "";
$mb_6 = isset($_POST['mb_6']) ? escape_trim($_POST['mb_6']) : "";
$mb_7 = isset($_POST['mb_7']) ? escape_trim($_POST['mb_7']) : "";
$mb_8 = isset($_POST['mb_8']) ? escape_trim($_POST['mb_8']) : "";
$mb_9 = isset($_POST['mb_9']) ? escape_trim($_POST['mb_9']) : "";
$mb_10 = isset($_POST['mb_10']) ? escape_trim($_POST['mb_10']) : "";
$mb_id = trim($_POST['mb_id']);
$mb_password = trim($_POST['mb_password']);
$mb_password_re = trim($_POST['mb_password_re']);
$mb_name = trim($_POST['mb_name']);
$mb_nick = trim($_POST['mb_nick']);
$mb_email = trim($_POST['mb_email']);
$mb_sex = isset($_POST['mb_sex']) ? trim($_POST['mb_sex']) : "";
$mb_birth = isset($_POST['mb_birth']) ? trim($_POST['mb_birth']) : "";
$mb_homepage = isset($_POST['mb_homepage']) ? trim($_POST['mb_homepage']) : "";
$mb_tel = isset($_POST['mb_tel']) ? trim($_POST['mb_tel']) : "";
$mb_hp = isset($_POST['mb_hp']) ? trim($_POST['mb_hp']) : "";
$mb_zip1 = isset($_POST['mb_zip1']) ? trim($_POST['mb_zip1']) : "";
$mb_zip2 = isset($_POST['mb_zip2']) ? trim($_POST['mb_zip2']) : "";
$mb_addr1 = isset($_POST['mb_addr1']) ? trim($_POST['mb_addr1']) : "";
$mb_addr2 = isset($_POST['mb_addr2']) ? trim($_POST['mb_addr2']) : "";
$mb_addr3 = isset($_POST['mb_addr3']) ? trim($_POST['mb_addr3']) : "";
$mb_addr_jibeon = isset($_POST['mb_addr_jibeon']) ? trim($_POST['mb_addr_jibeon']) : "";
$mb_signature = isset($_POST['mb_signature']) ? trim($_POST['mb_signature']) : "";
$mb_profile = isset($_POST['mb_profile']) ? trim($_POST['mb_profile']) : "";
$mb_recommend = isset($_POST['mb_recommend']) ? trim($_POST['mb_recommend']) : "";
$mb_mailling = isset($_POST['mb_mailling']) ? trim($_POST['mb_mailling']) : "";
$mb_sms = isset($_POST['mb_sms']) ? trim($_POST['mb_sms']) : "";
$mb_1 = isset($_POST['mb_1']) ? trim($_POST['mb_1']) : "";
$mb_2 = isset($_POST['mb_2']) ? trim($_POST['mb_2']) : "";
$mb_3 = isset($_POST['mb_3']) ? trim($_POST['mb_3']) : "";
$mb_4 = isset($_POST['mb_4']) ? trim($_POST['mb_4']) : "";
$mb_5 = isset($_POST['mb_5']) ? trim($_POST['mb_5']) : "";
$mb_6 = isset($_POST['mb_6']) ? trim($_POST['mb_6']) : "";
$mb_7 = isset($_POST['mb_7']) ? trim($_POST['mb_7']) : "";
$mb_8 = isset($_POST['mb_8']) ? trim($_POST['mb_8']) : "";
$mb_9 = isset($_POST['mb_9']) ? trim($_POST['mb_9']) : "";
$mb_10 = isset($_POST['mb_10']) ? trim($_POST['mb_10']) : "";
if ($w == '' || $w == 'u') {

10
bbs/visit_insert.inc.php
View File

@ -1,8 +1,8 @@
<?php
if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
if (!defined('_GNUBOARD_')) exit; // 개별 페이지 접근 불가
// 컴퓨터의 아이피와 쿠키에 저장된 아이피가 다르다면 테이블에 반영함
if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
{
set_cookie('ck_visit_ip', $_SERVER['REMOTE_ADDR'], 86400); // 하루동안 저장
@ -22,7 +22,7 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
if ($result) {
$sql = " insert {$g5['visit_sum_table']} ( vs_count, vs_date) values ( 1, '".G5_TIME_YMD."' ) ";
$result = sql_query($sql, FALSE);
// DUPLICATE 오류가 발생한다면 이미 날짜별 행이 생성되었으므로 UPDATE 실행
if (!$result) {
$sql = " update {$g5['visit_sum_table']} set vs_count = vs_count + 1 where vs_date = '".G5_TIME_YMD."' ";
@ -48,13 +48,13 @@ if (get_cookie('ck_visit_ip') != $_SERVER['REMOTE_ADDR'])
$vi_max = $row['cnt'];
// 전체
$sql = " select sum(vs_count) as total from {$g5['visit_sum_table']} ";
$sql = " select sum(vs_count) as total from {$g5['visit_sum_table']} ";
$row = sql_fetch($sql);
$vi_sum = $row['total'];
$visit = '오늘:'.$vi_today.',어제:'.$vi_yesterday.',최대:'.$vi_max.',전체:'.$vi_sum;
// 기본설정 테이블에 방문자수를 기록한 후
// 기본설정 테이블에 방문자수를 기록한 후
// 방문자수 테이블을 읽지 않고 출력한다.
// 쿼리의 수를 상당부분 줄임
sql_query(" update {$g5['config_table']} set cf_visit = '{$visit}' ");

4
bbs/write_comment_update.php
View File

@ -12,10 +12,10 @@ if (substr_count($wr_content, "&#") > 50) {
@include_once($board_skin_path.'/write_comment_update.head.skin.php');
$w = $_POST["w"];
$wr_name = escape_trim($_POST['wr_name']);
$wr_name = trim($_POST['wr_name']);
$wr_email = '';
if (!empty($_POST['wr_email']))
$wr_email = escape_trim($_POST['wr_email']);
$wr_email = trim($_POST['wr_email']);
// 비회원의 경우 이름이 누락되는 경우가 있음
if ($is_guest) {

8
bbs/write_update.php
View File

@ -50,8 +50,8 @@ if (empty($_POST)) {
}
$w = $_POST['w'];
$wr_link1 = escape_trim(strip_tags($_POST['wr_link1']));
$wr_link2 = escape_trim(strip_tags($_POST['wr_link2']));
$wr_link1 = trim(strip_tags($_POST['wr_link1']));
$wr_link2 = trim(strip_tags($_POST['wr_link2']));
$notice_array = explode(",", $board['bo_notice']);
@ -91,7 +91,7 @@ for ($i=1; $i<=10; $i++) {
$var = "wr_$i";
$$var = "";
if (isset($_POST['wr_'.$i]) && $_POST['wr_'.$i]) {
$$var = escape_trim($_POST['wr_'.$i]);
$$var = trim($_POST['wr_'.$i]);
}
}
@ -291,7 +291,7 @@ if ($w == '' || $w == 'r') {
} else {
$mb_id = '';
// 비회원의 경우 이름이 누락되는 경우가 있음
$wr_name = escape_trim($_POST['wr_name']);
$wr_name = trim($_POST['wr_name']);
if (!$wr_name)
alert('이름은 필히 입력하셔야 합니다.');
$wr_password = sql_password($wr_password);