From df8baf54fe4496e884a5adc48d39569761030f9e Mon Sep 17 00:00:00 2001
From: Jonathan Ernst <jonathan@ernstfamily.ch>
Date: Wed, 28 Jun 2006 17:30:44 +0000
Subject: [PATCH] Automatic filtering of $_REQUEST variables

---
 include/filter.php | 54 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 include/filter.php

diff --git a/include/filter.php b/include/filter.php
new file mode 100644
index 0000000..5a9663f
--- /dev/null
+++ b/include/filter.php
@@ -0,0 +1,54 @@
+<?php
+$aClean = array();
+filter_gpc();
+
+/*
+ * Make all get/post/cookies variable clean based on their names.
+ */
+function filter_gpc()
+{
+    global $aClean;
+    $aKeys = array_keys($_REQUEST);
+    for($i=0;$i<sizeof($aKeys);$i++)
+    {
+        switch($aKeys[$i][0])
+        {
+            case "i": // integer
+            case "f": // float
+                if(is_numeric($_REQUEST[$aKeys[$i]]))
+                    $aClean[$aKeys[$i]] = $_REQUEST[$aKeys[$i]];
+                else
+                    util_show_error_page("Fatal error: ".$aKeys[$i]." should be a numeric value.");
+            break;
+            case "b": // boolean
+                if($_REQUEST[$aKeys[$i]]=="true" || $_REQUEST[$aKeys[$i]]=="false")
+                    $aClean[$aKeys[$i]] = $_REQUEST[$aKeys[$i]];
+                else
+                    util_show_error_page("Fatal error: ".$aKeys[$i]." should be a boolean value.");
+            break;
+            case "s": // string
+                switch($aKeys[$i][1])
+                {
+                     case "h": // HTML string
+                         $aClean[$aKeys[$i]] = htmlspecialchars($_REQUEST[$aKeys[$i]]);
+                     break;
+                     default: // normal string (no HTML)
+                          $aClean[$aKeys[$i]] = strip_tags($_REQUEST[$aKeys[$i]]);
+                     break;
+                }
+            break;
+            default:
+                if($aKeys[$i]!="whq_appdb") // that's the name of the session cookie
+                    util_show_error_page("Fatal error: type of variable ".$aKeys[$i]." is not recognized.");
+            break;
+        }
+    }
+    
+    /* null out all input data so we can be assured that */
+    /* no unfiltered values are being used */
+    $_REQUEST = array();
+    $_POST = array();
+    $_GET = array();
+    $_COOKIES = array();
+}
+?>