devsam/core
3
6
Fork 1
Code Issues 60 Pull Requests Releases 1 Wiki Activity

SQL Injection 대응을 위해 파일 상단에 Util::getReq 사용

Browse Source
This commit is contained in:
Hide_D
2018-04-14 00:15:25 +09:00
parent be7154284e
commit 253a953dfe
21 changed files with 225 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hwe/c_chiefboard.php
+32 -29
View File
@@ -17,39 +17,42 @@ $userID = Session::getUserID();
$db = DB::db();
$connect=$db->get();
if(getBlockLevel() != 1 && getBlockLevel() != 3) {
$query = "select no,nation from general where owner='{$userID}'";
$result = MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
$me = MYDB_fetch_array($result);
if (getBlockLevel() == 1 || getBlockLevel() == 3) {
header('location:b_chiefboard.php');
die();
}
$title = str_replace("|", " ", $title);
$msg = str_replace("|", " ", $msg);
$reply = str_replace("|", " ", $reply);
$title = trim($title);
$msg = trim($msg);
$reply = trim($reply);
$query = "select no,nation from general where owner='{$userID}'";
$result = MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
$me = MYDB_fetch_array($result);
$nation = getNation($me['nation']);
$title = str_replace("|", " ", $title);
$msg = str_replace("|", " ", $msg);
$reply = str_replace("|", " ", $reply);
$title = trim($title);
$msg = trim($msg);
$reply = trim($reply);
//새글 추가시
if($num == -1 && $title != "" && $msg != "") {
$num = $nation['coreindex'] + 1;
if($num >= 20) { $num = 0; }
$msg = $title."|".$msg;
$msg = addslashes(SQ2DQ($msg));
$date = date('Y-m-d H:i:s');
$query = "update nation set coreboard{$num}='$msg',coreboard{$num}_who='{$me['no']}',coreboard{$num}_when='$date' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
$query = "update nation set coreindex='$num' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
//$num에 댓글시
} elseif($num >= 0 && $reply != "") {
$newmsg = $nation["coreboard{$num}"]."|".$me['no']."|".$reply;
$newmsg = addslashes(SQ2DQ($newmsg));
$nation = getNation($me['nation']);
$query = "update nation set coreboard{$num}='$newmsg' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
}
//새글 추가시
if($num == -1 && $title != "" && $msg != "") {
$num = $nation['coreindex'] + 1;
if($num >= 20) { $num = 0; }
$msg = $title."|".$msg;
$msg = addslashes(SQ2DQ($msg));
$date = date('Y-m-d H:i:s');
$query = "update nation set coreboard{$num}='$msg',coreboard{$num}_who='{$me['no']}',coreboard{$num}_when='$date' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
$query = "update nation set coreindex='$num' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
//$num에 댓글시
} elseif($num >= 0 && $reply != "") {
$newmsg = $nation["coreboard{$num}"]."|".$me['no']."|".$reply;
$newmsg = addslashes(SQ2DQ($newmsg));
$query = "update nation set coreboard{$num}='$newmsg' where nation='{$me['nation']}'";
MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
}
header('location:b_chiefboard.php');