From b534da34ad91bd3236378c2b0caeda17777a0c0d Mon Sep 17 00:00:00 2001
From: hide_d <hided62@gmail.com>
Date: Sun, 24 Jun 2018 04:44:34 +0900
Subject: [PATCH] =?UTF-8?q?=EC=8A=A4=ED=8E=98=EC=9D=B4=EC=8A=A4=20?=
 =?UTF-8?q?=EB=B0=94=20=EB=93=B1=20=EB=AA=87=EB=AA=87=20=EB=AC=B8=EC=9E=90?=
 =?UTF-8?q?=EC=97=B4=20=EA=B0=80=EB=8A=A5=ED=95=98=EA=B2=8C=20=EC=B2=98?=
 =?UTF-8?q?=EB=A6=AC=20&=20=EB=AC=B8=EC=9E=90=EC=97=B4=20=EB=B3=B4?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hwe/c_double.php               | 35 +++++++++++++++++-----------------
 hwe/func_process_personnel.php |  9 +++++++--
 hwe/join_post.php              |  3 +++
 src/sammo/StringUtil.php       | 13 +++++++++----
 4 files changed, 37 insertions(+), 23 deletions(-)

diff --git a/hwe/c_double.php b/hwe/c_double.php
index 941a619e..dec5ac2f 100644
--- a/hwe/c_double.php
+++ b/hwe/c_double.php
@@ -44,12 +44,12 @@ $comStr = EncodeCommand($fourth, $third, $double, $command);
 
 // 건국
 if($command == 46) {
-    $name = addslashes(SQ2DQ($name));
-    $name = str_replace("|", "", $name);
-    $name = str_replace(" ", "", $name);
-    $name = str_replace("　", "뷁", $name);
-    if($name == "") { $name = "무명"; }
+    $name = htmlspecialchars($name);
+    $name = StringUtil::removeSpecialCharacter($name);
     $name = StringUtil::subStringForWidth($name, 0, 18);
+    $name = WebUtil::htmlPurify($name);
+    $name = StringUtil::textStrip($name);
+    if($name == "") { $name = "무명"; }
 
     $db->update('general', [
         'makenation'=>$name
@@ -72,15 +72,16 @@ if($command == 53) {
     $me = MYDB_fetch_array($result);
 
     if($me['level'] >= 5) {
-        $nationname = addslashes(SQ2DQ($nationname));
-        $nationname = str_replace("|", "", $nationname);
-        $nationname = str_replace(" ", "", $nationname);
-        $nationname = str_replace("　", "뷁", $nationname);
-        if($nationname == "") { $nationname = "무명"; }
+        $nationname = htmlspecialchars($nationname);
+        $nationname = StringUtil::removeSpecialCharacter($nationname);
         $nationname = StringUtil::subStringForWidth($nationname, 0, 18);
-
-        $query = "update general set makenation='{$nationname}' where level>=5 and nation='{$me['nation']}'";
-        MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+        $nationname = WebUtil::htmlPurify($nationname);
+        $nationname = StringUtil::textStrip($nationname);
+        if($nationname == "") { $nationname = "무명"; }
+        
+        $db->update('general', [
+            'makenation'=>$nationname
+        ], 'level>=5 and nation=%i', $me['nation']);
 
         $count = count($turn);
         $str = "type=type";
@@ -101,11 +102,11 @@ if($command == 61) {
     $me = MYDB_fetch_array($result);
 
     if($me['level'] >= 5) {
-        $note = addslashes(SQ2DQ($note));
-        $note = str_replace("|", "", $note);
-        $note = str_replace(" ", "", $note);
-        $note = str_replace("　", "뷁", $note);
+        $note = htmlspecialchars($note);
+        $note = StringUtil::removeSpecialCharacter($note);
         $note = StringUtil::subStringForWidth($note, 0, 90);
+        $note = WebUtil::htmlPurify($note);
+        $note = StringUtil::textStrip($note);
 
         $query = "update diplomacy set reserved='{$note}' where me='{$me['nation']}' and you='$double'";
         MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
diff --git a/hwe/func_process_personnel.php b/hwe/func_process_personnel.php
index 4d5ecf24..aa645a92 100644
--- a/hwe/func_process_personnel.php
+++ b/hwe/func_process_personnel.php
@@ -663,8 +663,13 @@ function process_46(&$general) {
     } elseif($city['level'] != 5 && $city['level'] != 6) {
         $log[] = "<C>●</>{$admin['month']}월:중, 소 도시에서만 가능합니다. 건국 실패. <1>$date</>";
     } else {
-        $query = "update nation set name='{$general['makenation']}',color='$color',level=1,type='$type',capital='{$general['city']}' where nation='{$general['nation']}'";
-        MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+        $db->update('nation', [
+            'name'=>$general['makenation'],
+            'color'=>$color,
+            'level'=>1,
+            'type'=>$type,
+            'capital'=>$general['city'],
+        ], 'nation=%i', $general['nation']);
 
         refreshNationStaticInfo();
         $nation = getNationStaticInfo($general['nation']);
diff --git a/hwe/join_post.php b/hwe/join_post.php
index ef265a27..3cabf165 100644
--- a/hwe/join_post.php
+++ b/hwe/join_post.php
@@ -43,7 +43,10 @@ $userID = Session::getUserID();
 //NOTE: 이 페이지에서는 세션에 데이터를 등록하지 않음. 로그인은 이후에.
 
 $name       = Util::getReq('name');
+$name       = htmlspecialchars($name);
 $name       = StringUtil::removeSpecialCharacter($name);
+$name       = WebUtil::htmlPurify($name);
+$name       = StringUtil::textStrip($name);
 $pic        = (int)Util::getReq('pic', 'bool', 0);
 $character  = Util::getReq('character', 'int', 0);
 
diff --git a/src/sammo/StringUtil.php b/src/sammo/StringUtil.php
index daf32e86..31f2f3a8 100644
--- a/src/sammo/StringUtil.php
+++ b/src/sammo/StringUtil.php
@@ -150,13 +150,18 @@ class StringUtil
         return $str;
     }
 
+    public static function textStrip(?string $str):string{
+        if(!$str){
+            return '';
+        }
+        return preg_replace('/^[\pZ\pC]+|[\pZ\pC]+$/u','',$str);
+    }
+
     public static function removeSpecialCharacter($str)
     {
         return str_replace([
-            ' ', '"', '\'', 'ⓝ', 'ⓜ', 'ⓖ', '\\', '/', '`',
-            '-', '=', '[', ']', ';', ',', '.', '~', '!', '@',
-            '#', '$', '%', '^', '&', '*', '(', ')', '_', '+',
-            '|', '{', '}', ':', '', '<', '>', '?', '　'
+            '"', '\'', 'ⓝ', 'ⓜ', 'ⓖ', '\\', '/', '`', '#',
+            '-', '#', '|'
         ], '', $str);
     }