Далёкий 2003:
// запрет тегов переданных методом Get, а чё Post-том можно?
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*over*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ("<center><img src=images/logo.gif>
<b>The html tags you attempted to use are not allowed</b>
[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
}
//--------------------------------------------------------------------------
// А вот и POST. А почему мало. Ведь кроме over есть ещё и
foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*over*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ("<center><img src=images/logo.gif>
<b>The html tags you attempted to use are not allowed</b>
[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
//Это я написал http://chajnik.ru
$u='((<a)|(\[url))';
//$u='<a';
if(
preg_match("/$u.*$u/is", $secvalue)
or preg_match("/viagra/i", $secvalue)
or preg_match("/good site/i", $secvalue)
or preg_match("/Nice site/i", $secvalue)
or preg_match("/great site/i", $secvalue)
or preg_match("/Cool site. Thank/i", $secvalue)
){header("Location: index.php"); die();}
//Конец моей писанины
}