스페이스 바 등 몇몇 문자열 가능하게 처리 & 문자열 보정

hwe/c_double.php

@@ -44,12 +44,12 @@ $comStr = EncodeCommand($fourth, $third, $double, $command);
 
 // 건국
 if($command == 46) {
-    $name = addslashes(SQ2DQ($name));
-    $name = str_replace("|", "", $name);
-    $name = str_replace(" ", "", $name);
-    $name = str_replace("　", "뷁", $name);
-    if($name == "") { $name = "무명"; }
+    $name = htmlspecialchars($name);
+    $name = StringUtil::removeSpecialCharacter($name);
     $name = StringUtil::subStringForWidth($name, 0, 18);
+    $name = WebUtil::htmlPurify($name);
+    $name = StringUtil::textStrip($name);
+    if($name == "") { $name = "무명"; }
 
     $db->update('general', [
         'makenation'=>$name
@@ -72,15 +72,16 @@ if($command == 53) {
     $me = MYDB_fetch_array($result);
 
     if($me['level'] >= 5) {
-        $nationname = addslashes(SQ2DQ($nationname));
-        $nationname = str_replace("|", "", $nationname);
-        $nationname = str_replace(" ", "", $nationname);
-        $nationname = str_replace("　", "뷁", $nationname);
-        if($nationname == "") { $nationname = "무명"; }
+        $nationname = htmlspecialchars($nationname);
+        $nationname = StringUtil::removeSpecialCharacter($nationname);
         $nationname = StringUtil::subStringForWidth($nationname, 0, 18);
-
-        $query = "update general set makenation='{$nationname}' where level>=5 and nation='{$me['nation']}'";
-        MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+        $nationname = WebUtil::htmlPurify($nationname);
+        $nationname = StringUtil::textStrip($nationname);
+        if($nationname == "") { $nationname = "무명"; }
+        
+        $db->update('general', [
+            'makenation'=>$nationname
+        ], 'level>=5 and nation=%i', $me['nation']);
 
         $count = count($turn);
         $str = "type=type";
@@ -101,11 +102,11 @@ if($command == 61) {
     $me = MYDB_fetch_array($result);
 
     if($me['level'] >= 5) {
-        $note = addslashes(SQ2DQ($note));
-        $note = str_replace("|", "", $note);
-        $note = str_replace(" ", "", $note);
-        $note = str_replace("　", "뷁", $note);
+        $note = htmlspecialchars($note);
+        $note = StringUtil::removeSpecialCharacter($note);
         $note = StringUtil::subStringForWidth($note, 0, 90);
+        $note = WebUtil::htmlPurify($note);
+        $note = StringUtil::textStrip($note);
 
         $query = "update diplomacy set reserved='{$note}' where me='{$me['nation']}' and you='$double'";
         MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");

hwe/func_process_personnel.php

@@ -663,8 +663,13 @@ function process_46(&$general) {
     } elseif($city['level'] != 5 && $city['level'] != 6) {
         $log[] = "<C>●</>{$admin['month']}월:중, 소 도시에서만 가능합니다. 건국 실패. <1>$date</>";
     } else {
-        $query = "update nation set name='{$general['makenation']}',color='$color',level=1,type='$type',capital='{$general['city']}' where nation='{$general['nation']}'";
-        MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+        $db->update('nation', [
+            'name'=>$general['makenation'],
+            'color'=>$color,
+            'level'=>1,
+            'type'=>$type,
+            'capital'=>$general['city'],
+        ], 'nation=%i', $general['nation']);
 
         refreshNationStaticInfo();
         $nation = getNationStaticInfo($general['nation']);

hwe/join_post.php

@@ -43,7 +43,10 @@ $userID = Session::getUserID();
 //NOTE: 이 페이지에서는 세션에 데이터를 등록하지 않음. 로그인은 이후에.
 
 $name       = Util::getReq('name');
+$name       = htmlspecialchars($name);
 $name       = StringUtil::removeSpecialCharacter($name);
+$name       = WebUtil::htmlPurify($name);
+$name       = StringUtil::textStrip($name);
 $pic        = (int)Util::getReq('pic', 'bool', 0);
 $character  = Util::getReq('character', 'int', 0);
 

src/sammo/StringUtil.php

@@ -150,13 +150,18 @@ class StringUtil
         return $str;
     }
 
+    public static function textStrip(?string $str):string{
+        if(!$str){
+            return '';
+        }
+        return preg_replace('/^[\pZ\pC]+|[\pZ\pC]+$/u','',$str);
+    }
+
     public static function removeSpecialCharacter($str)
     {
         return str_replace([
-            ' ', '"', '\'', 'ⓝ', 'ⓜ', 'ⓖ', '\\', '/', '`',
-            '-', '=', '[', ']', ';', ',', '.', '~', '!', '@',
-            '#', '$', '%', '^', '&', '*', '(', ')', '_', '+',
-            '|', '{', '}', ':', '', '<', '>', '?', '　'
+            '"', '\'', 'ⓝ', 'ⓜ', 'ⓖ', '\\', '/', '`', '#',
+            '-', '#', '|'
         ], '', $str);
     }