Changeset 23 for trunk/client

Timestamp:

Mar 5, 2010, 1:53:30 PM (15 years ago)

Author:

roby

Message:

Gestione charset con query mysql e sostituzione funzioni ereg

Location:

trunk/client

Files:

• file.php (modified) (1 diff)
• modules.php (modified) (5 diffs)
• modules/Elezioni/grafici-old (deleted)

trunk/client/file.php

@@ -10 +10 @@
 die("<center><img src=src=\"images/logo.gif\" target=\"Logo Avviso Errore\"><br><br><b>Ci sono dei problemi di connessione al DataBase $dbtype, chiediamo scusa per l'inconveniente.<br><br>Provate piu' tardi, Grazie.</b><br><font color=\"#ff0000\">". mysql_error()."</font></center>");
 }
-mysql_set_charset('utf8', $dbi);
+mysql_query("SET NAMES 'utf8'", $dbi);
 if ($fase=='1'){
         $res = mysql_query("SELECT id_cons_gen,descrizione from ".$prefix."_ele_consultazione order by descrizione",$dbi);

trunk/client/modules.php

@@ -35 +35 @@
 
 foreach ($_GET as $sec_key => $secvalue) {
-    if ((preg_match('/<[^>]*script*\"?[^>]*>/i', $secvalue)) ||
-        (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
-        (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) ||
-        (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
-        (eregi("\"", $secvalue)) ||
-        (eregi("inside_mod", $sec_key))) {
+    if ((preg_match("/<[^>]*script*\"?[^>]*>/i",$secvalue)) ||
+        (preg_match("/<[^>]*object*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*iframe*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*applet*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*meta*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*style*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*form*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*img*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*onmouseover*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/<[^>]*body*\"?[^>]*>/i", $secvalue)) ||
+        (preg_match("/\([^>]*\"?[^)]*\)/", $secvalue)) ||
+        (preg_match("/\"/", $secvalue)) ||
+        (preg_match("/inside_mod/i", $sec_key))) {
         die ("Operazione non consentita");
      }
@@ -53 +53 @@
 
   foreach ($_POST as $secvalue) {
-    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
+    if ((preg_match("/<[^>]*onmouseover*\"?[^>]*>/i", $secvalue)) || (preg_match("/<[^>]script*\"?[^>]*>/i", $secvalue)) || (preg_match("/<[^>]*body*\"?[^>]*>/i", $secvalue)) || (preg_match("/<[^>]style*\"?[^>]*>/i", $secvalue))) {
       die ($htmltags);
     }
@@ -74 +74 @@
 global $op,$name;
 if(!isset($_GET['js'])){
-$querystring= @eregi_replace($_SERVER['DOCUMENT_ROOT'],'http://'.$_SERVER['HTTP_HOST'].'/',$_SERVER['SCRIPT_FILENAME']);
-if (eregi("modules.php",$_SERVER['SCRIPT_NAME'])) $pagina="name=$name"; // reindirizza
-if (eregi("admin.php",$_SERVER['SCRIPT_NAME'])) $pagina="op=$op"; // reindirizza
+$querystring= @preg_replace('/'.$_SERVER['DOCUMENT_ROOT'].'/i','http://'.$_SERVER['HTTP_HOST'].'/',$_SERVER['SCRIPT_FILENAME']);
+if (preg_match("/modules.php/i",$_SERVER['SCRIPT_NAME'])) $pagina="name=$name"; // reindirizza
+if (preg_match("/admin.php/i",$_SERVER['SCRIPT_NAME'])) $pagina="op=$op"; // reindirizza
  echo "<noscript><meta http-equiv=\"refresh\" content=\"0; url=".$querystring."?js=b&amp;$pagina\"/></noscript>";
   }
@@ -104 +104 @@
 die("<center><img src=src=\"images/logo.gif\" target=\"Logo Avviso Errore\"><br/><br/><b>Ci sono dei problemi di connessione al DataBase $dbtype, chiediamo scusa per l'inconveniente.<br/><br/>Provate piu' tardi, Grazie.</b><br/><font color=\"#ff0000\">". mysql_error()."</font></center>");
 }
-mysql_set_charset('utf8', $dbi);
+mysql_query("SET NAMES 'utf8'", $dbi);
 
 # carica i parametri di default sulla tabella
@@ -210 +210 @@
         $tema=$param['tema'];
         $tema=htmlentities($tema); // evita xss
-        if(eregi("%", $tema)) $tema="default";// evita xss
+        if(preg_match("/%/i", $tema)) $tema="default";// evita xss
         $_SESSION['newtema']="$tema";
         }
 
-if (eregi("%",$_SESSION['newtema'])) $_SESSION['newtema']="default"; // xss
+if (preg_match("/%/i",$_SESSION['newtema'])) $_SESSION['newtema']="default"; // xss
 if (isset($_SESSION['newtema'])) $tema=$_SESSION['newtema'];