<?php
// Stop Injections

$SQLInjectionRegexOR = '/[\'")]* *[o][r] *.*(.)(.) *= *\\2(?:--)?\\1?/i';
$suspiciousQueryItemsOR = preg_grep($SQLInjectionRegexOR, $_REQUEST);
if (!empty($suspiciousQueryItemsOR)) die('This is not allowed. If you believe we have made a mistake, then go here in the forum and share this: <a target="_blank" href="http://www.bigware.de/forum/erfahrungsaustausch-zum-sicherheitsupdate-36-t1984.html">Forumthread</a>');

$SQLInjectionRegexAND = '/[\'")]* *[a][n][d] *.*(.)(.) *= *\\2(?:--)?\\1?/i';
$suspiciousQueryItemsAND = preg_grep($SQLInjectionRegexAND, $_REQUEST);
if (!empty($suspiciousQueryItemsAND)) die('This is not allowed. If you believe we have made a mistake, then go here in the forum and share this: <a target="_blank" href="http://www.bigware.de/forum/erfahrungsaustausch-zum-sicherheitsupdate-36-t1984.html">Forumthread</a>');


# strips slashes to a multi dimensional array, by reference
   function stripslashes_arrays(&$array) {
      if ( is_array($array) ) {
         $keys = array_keys($array);
         foreach ( $keys as $key ) {
            if ( is_array($array[$key]) ) {
               stripslashes_arrays($array[$key]);
            }
            else {
               $array[$key] = stripslashes($array[$key]);
               $array[$key] = str_replace("<", "&lt;", $array[$key]);
            }
         }
      }
   }
   function addcslashes_arrays_get(&$array) {
      if ( is_array($array) ) {
         $keys = array_keys($array);
         foreach ( $keys as $key ) {
            if ( is_array($array[$key]) ) {
               addcslashes_arrays_get($array[$key]);
            }
            else {
            	$array[$key] = addcslashes($array[$key], "/*");
              $array[$key] = str_replace('<', '&lt;', $array[$key]);
              if (substr_count(strtolower($array[$key]), strtolower('include(')) || substr_count(strtolower($array[$key]), strtolower('$_GET'))){
	              $array[$key] = str_replace(strtolower('include('), '', strtolower($array[$key]));
	              $array[$key] = str_replace(strtolower('$_GET'), '', strtolower($array[$key]));
            	}
            }
         }
      }
   }
  
		# --- Handle input var escapes
		# magic_quotes_runtime could corrupt data,
		# so make sure it's turned off...
   if (get_magic_quotes_runtime()) {
       ini_set("magic_quotes_runtime", 0);
   }
		# All escapes are handled from code...
		# So rather, strip slashes if magic quotes is enabled
   if(get_magic_quotes_gpc() == 0) {
      stripslashes_arrays($_GET);
      addcslashes_arrays_get($_GET);
      stripslashes_arrays($_POST);
      stripslashes_arrays($_COOKIE);
			#     stripslashes_arrays($_FILES);
			# verify $_FILES gets escapes by MAGIC_QUOTES first
   }
   else{
   	addcslashes_arrays_get($_GET);
   }
// Injections ENDE
?>
