PHP Remove_SQLi Beispiele

Beispiel #1

Datei: Application_Reprint.php Projekt: BipadTaranMahato/DCPS-Recruitment

function check_pin_appid($pin, $appid)
{
    $retval = false;
    $sqlstr = "select * from applicant where appid = '" . Remove_SQLi($appid) . "' and pin = '" . Remove_SQLi($pin) . "'";
    $rec = executeSqlQuery($sqlstr);
    if ($row = mysql_fetch_array($rec)) {
        $retval = true;
    } else {
        $retval = false;
    }
    return $retval;
}

Beispiel #2

Datei: Add_image.php Projekt: BipadTaranMahato/DCPS-Recruitment

function appid_exists($appid)
{
    $retval = false;
    $sqlstr = "select * from uploadfile where appid = '" . Remove_SQLi($appid) . "'";
    $rec = executeSqlQuery($sqlstr);
    if ($row = mysql_fetch_array($rec)) {
        $retval = true;
    } else {
        $retval = false;
    }
    return $retval;
}

Beispiel #3

Datei: sign.php Projekt: BipadTaranMahato/DCPS-Recruitment

<?php

/**
 * @author
 * @copyright 2010
 */
include "connection.php";
if (isset($_GET['appid'])) {
    $sqlstr = "select signname,signtype,signsize,signcontent from uploadfile where appid ='" . Remove_SQLi(htmlspecialchars(trim($_GET['appid']))) . "'";
    $application = executeSqlQuery($sqlstr);
    $row = mysql_fetch_array($application);
    header("Content-length: " . $row["signsize"]);
    header("Content-type: " . $row["signtype"]);
    header("Content-Disposition: attachment; filename=" . $row["signname"]);
    echo $row["signcontent"];
    exit;
} else {
    echo "<script type=\"text/javascript\">alert(\"ERROR:: Registration No. is not entered properly. Pls Check\")</script>";
}

Beispiel #4

Datei: Application_entry.php Projekt: BipadTaranMahato/DCPS-Recruitment

function GetappId($post)
{
    $slno = "";
    $sqlstr = "select * from post where PostCode = '" . Remove_SQLi($post) . "'";
    $maxno = executeSqlQuery($sqlstr);
    if ($row = mysql_fetch_array($maxno)) {
        $slno = $row["abbr"] . "/" . $row["SlNo"];
        $str = "update post set SlNo = SlNo + 1 where PostCode = '" . Remove_SQLi($post) . "'";
        executeSqlQuery($str);
    } else {
        echo "<script type=\"text/javascript\">alert(\"ERROR :: Registration No not Set in Database. Please call admin\")</script>";
    }
    return $slno;
}

Beispiel #5

Datei: forgetpin.php Projekt: santosh84das/DCPS-Recruitment

function check_appid($appid, &$pin)
{
    $email = "";
    $sqlstr = "select * from applicant where appid = '" . Remove_SQLi($appid) . "'";
    $rec = executeSqlQuery($sqlstr);
    if ($row = mysql_fetch_array($rec)) {
        $email = $row["email"];
        $pin = $row["pin"];
    } else {
        $email = "";
        $pin = "";
    }
    return $email;
}

Beispiel #6

Datei: check.php Projekt: santosh84das/DCPS-Recruitment

    }
} else {
    $_SESSION['Token'] = md5($_SERVER['REMOTE_ADDR'] . $_SESSION['ID'] . time());
    $Qry = "INSERT INTO audit_trail (`SessionID`,`IP`,`Referrer`,`UserAgent`,`UserID`,`URL`,`Action`,`Method`,`URI`) values" . "('" . session_id() . "','" . $_SERVER['REMOTE_ADDR'] . "','" . mysql_real_escape_string($_SERVER['HTTP_REFERER']) . "','" . $_SERVER['HTTP_USER_AGENT'] . "','" . $_SESSION['userid'] . "','" . mysql_real_escape_string($_SERVER['PHP_SELF']) . "','Login: Anonymous Browsing','" . mysql_real_escape_string($_SERVER['REQUEST_METHOD']) . "','" . mysql_real_escape_string($_SERVER['REQUEST_URI'] . $_SERVER['QUERY_STRING']) . "')";
    executeSqlQuery($Qry);
}
if ($LogC > 5) {
    $action = "NoMoreTry";
} else {
    if (isset($_POST['LoginToken']) && $_POST['LoginToken'] != $_SESSION['Token']) {
        $action = "NoAccess";
    } else {
        if (!empty($_POST['user'])) {
            $img = new Securimage();
            $valid = $img->check($_POST['code']);
            $sqlstr = "SELECT * FROM user where userid ='" . Remove_SQLi(htmlspecialchars($_POST['user'])) . "' AND md5(concat(md5(`pass`),md5('" . $_POST['LoginToken'] . "')))='" . Remove_SQLi(htmlspecialchars($_POST['passWD'])) . "'";
            $result = executeSqlQuery($sqlstr);
            $row = mysql_fetch_array($result);
            if ($row != NULL && $valid) {
                session_regenerate_id();
                $_SESSION['userid'] = $row['userid'];
                $_SESSION['ID'] = session_id();
                $action = "JustLoggedIn";
                $Qry = "INSERT INTO audit_trail (`SessionID`,`IP`,`Referrer`,`UserAgent`,`UserID`,`URL`,`Action`,`Method`,`URI`) values" . "('" . $_SESSION['ID'] . "','" . $_SERVER['REMOTE_ADDR'] . "','" . mysql_real_escape_string($_SERVER['HTTP_REFERER']) . "','" . $_SERVER['HTTP_USER_AGENT'] . "','" . $_SESSION['userid'] . "','" . mysql_real_escape_string($_SERVER['PHP_SELF']) . "','Login: Success','" . mysql_real_escape_string($_SERVER['REQUEST_METHOD']) . "','" . mysql_real_escape_string($_SERVER['REQUEST_URI'] . $_SERVER['QUERY_STRING']) . "')";
                executeSqlQuery($Qry);
            } else {
                $action = "NoAccess";
                $Qry = "INSERT INTO audit_trail (`SessionID`,`IP`,`Referrer`,`UserAgent`,`UserID`,`URL`,`Action`,`Method`,`URI`) values" . "('" . $_SESSION['ID'] . "','" . $_SERVER['REMOTE_ADDR'] . "','" . mysql_real_escape_string($_SERVER['HTTP_REFERER']) . "','" . $_SERVER['HTTP_USER_AGENT'] . "','" . $_POST['user'] . "','" . mysql_real_escape_string($_SERVER['PHP_SELF']) . "','Login: Failed','" . mysql_real_escape_string($_SERVER['REQUEST_METHOD']) . "','" . mysql_real_escape_string($_SERVER['REQUEST_URI'] . $_SERVER['QUERY_STRING']) . "')";
                executeSqlQuery($Qry);
            }
        }