1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
| <?php
include ('config.php');
?>
<div id="corps">
<?php
function asinject($hstack) {
$chars = array();
$chars[] = '"';
$chars[] = "'";
$chars[] = ";";
$chars[] = "\\";
$chars[] = "//";
$chars[] = "#";
$chars[] = "--";
$chars[] = "/*";
$injectcount = 0;
foreach($chars as $char) {
if(strpos($hstack, $char) != false) {
$injectcount++;
}
}
if($injectcount != 0) {
return true;
} else {
return false;
}
}
if(asinject($_POST['Password']) or asinject($_POST['nom'])) {
// rajouter un or pour tous les champs
die('mauvais caractère');
}
// reste du code ici
$Login = $_POST["login"];
$Password = md5($_POST["Password"]);
$Niveau = $_POST["Niveau"];
$Email = $_POST["Email"];
$Joindate = $_POST["Joindate"];
$Nom = $_POST["Nom"];
$Pseudo = $_POST["Pseudo"];
$Steamid = $_POST["Steamid"];
$Skype = $_POST["Skype"];
$Micro = $_POST["Micro"];
$Autre = $_POST["Autre"];
$requete ="INSERT INTO Enregistrer (Login,Password,Niveau,Email,Joindate,Nom,Pseudo,steamid,Skype,Micro,Autre) VALUES('$Login',MD5('$Password'),'Niveau','$Email','$Joindate','$Nom','$Pseudo','$steamid','$Skype','$Micro','$Autre')";
mysql_query($requete);
?> |