<?
/**
 * @Project GoldMU.Net
 * @copyright 03/03/2022
 * @Email: goldmu.net@gmail.com
 * @Zalo: 0923 117 898
*/
$tracker = strtolower($_SERVER['QUERY_STRING']);
$wormprotector = array('chr(', 'chr=', 'chr%20', '%20chr', 'wget%20', '%20wget', 'wget(',
'cmd=', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
'union%20', '%20union', 'union(', 'union=', 'echr(', '%20echr', 'echr%20', 'echr=',
'esystem(', 'esystem%20', 'cp%20', '%20cp', 'cp(', 'mdir%20', '%20mdir', 'mdir(',
'mcd%20', 'mrd%20', 'rm%20', '%20mcd', '%20mrd', '%20rm',
'mcd(', 'mrd(', 'rm(', 'mcd=', 'mrd=', 'mv%20', 'rmdir%20', 'mv(', 'rmdir(',
'chmod(', 'chmod%20', '%20chmod', 'chmod(', 'chmod=', 'chown%20', 'chgrp%20', 'chown(', 'chgrp(',
'locate%20', 'grep%20', 'locate(', 'grep(', 'diff%20', 'kill%20', 'kill(', 'killall',
'passwd%20', '%20passwd', 'passwd(', 'telnet%20', 'vi(', 'vi%20',
'insert%20into', 'select%20', 'nigga(', '%20nigga', 'nigga%20', 'fopen', 'fwrite', '%20like', 'like%20',
'$_request', '$_get', '$request', '$get', '.system', 'http_php', '&aim', '%20getenv', 'getenv%20',
'new_password', '&icq','/etc/password','/etc/shadow', '/etc/groups', '/etc/gshadow',
'http_user_agent', 'http_host', '/bin/ps', 'wget%20', 'uname\x20-a', '/usr/bin/id',
'/bin/echo', '/bin/kill', '/bin/', '/chgrp', '/chown', '/usr/bin', 'g\+\+', 'bin/python',
'bin/tclsh', 'bin/nasm', 'perl%20', 'traceroute%20', 'ping%20', '.pl', '/usr/X11R6/bin/xterm', 'lsof%20',
'/bin/mail', '.conf', 'motd%20', 'http/1.', '.inc.php', 'config.php', 'cauhinh.php', 'cgi-', '.eml',
'file\://', 'window.open', '<script>', 'javascript\://','img src', 'img%20src','.jsp','ftp.exe',
'xp_enumdsn', 'xp_availablemedia', 'xp_filelist', 'xp_cmdshell', 'nc.exe', '.htpasswd',
'servlet', '/etc/passwd', 'wwwacl', '~root', '~ftp', '.js', '.jsp', 'admin_', '.history',
'bash_history', '.bash_history', '~nobody', 'server-info', 'server-status', 'reboot%20', 'halt%20',
'powerdown%20', '/home/ftp', '/home/www', 'secure_site, ok', 'chunked', 'org.apache', '/servlet/con',
'<script', '/robot.txt' ,'/perl' ,'mod_gzip_status', 'db_mysql.inc', '.inc', 'select%20from',
'select from', 'drop%20', '.system', 'getenv', 'http_', '_php', 'php_', 'phpinfo()', '<?php', '?>', 'sql=');
$checkworm = str_replace($wormprotector, 'vwebinject', $tracker);
if ($tracker != $checkworm)
{
	$log = "SQL Injection Detected (Bad Char in $tracker) $checkworm, IP: ".$_SERVER['REMOTE_ADDR'].", #0.";
	WriteLog_($log,'vweb_protect');
	die( "<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">Dữ liệu đã bị cấm sử dụng! #0." );
}

if(!function_exists(check_inject)) {
	function check_inject(){
		$badwords = array("xp_cmdshell","EXEC","insert","INSERT","DROP", "SELECT", "UPDATE", "DELETE", "drop", "select", "update", "delete", "WHERE", "where", "shutdown", "SHUTDOWN");
		foreach($_POST as $value)
		foreach($badwords as $word)
		if(substr_count($value, $word) > 0) {
			$log = "SQL Injection Detected (Bad Char in $value), IP: ".$_SERVER['REMOTE_ADDR'].", #1";
			WriteLog_($log,'vweb_protect');
			die("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">Lỗi: ký tự ($value) không được phép sử dụng #1.");
		};
		foreach($_GET as $value)
		foreach($badwords as $word)
		if(substr_count($value, $word) > 0) {
			$log = "SQL Injection Detected (Bad Char in $value), IP: ".$_SERVER['REMOTE_ADDR'].", #2";
			WriteLog_($log,'vweb_protect');
			die("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">Lỗi: ký tự ($value) không được phép sử dụng #2.");
		};
		foreach($_COOKIE as $value)
		foreach($badwords as $word)
		if(substr_count($value, $word) > 0) {
			$log = "SQL Injection Detected (Bad Char in $value), IP: ".$_SERVER['REMOTE_ADDR'].", #3";
			WriteLog_($log,'vweb_protect');
			die("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">Lỗi: ký tự ($value) không được phép sử dụng #3.");
		};
		foreach($_REQUEST as $value)
		foreach($badwords as $word)
		if(substr_count($value, $word) > 0) {
			$log = "SQL Injection Detected (Bad Char in $value), IP: ".$_SERVER['REMOTE_ADDR'].", #4";
			WriteLog_($log,'vweb_protect');
			die("<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">Lỗi: ký tự ($value) không được phép sử dụng #4.");
		};
	}
}

if(!function_exists(antiinject_query)) {
	function antiinject_query($value) {
		$value = addslashes($value);
		$value = strip_tags($value);
        $value = htmlspecialchars($value, ENT_QUOTES, "UTF-8");
        return $value;
    }
}

if(!function_exists(clean_variable)) {
	function clean_variable($var)
	{
		$newvar = preg_replace('/[^a-zA-Z0-9\_\?\-\@\ \,\!\>\<\=\"\#\|\$\%\:\;\'\^\/\\\+\-\&\*\(\)\`\.\}\{\]\[]/', '', $var);
		return $newvar;
	}
}

if(!function_exists(vweb_sanitycheck)) {
	function vweb_sanitycheck($str){
		if(strpos(str_replace("''",""," $str"),"'")!=false)
			return str_replace("'", "''", $str);
		else
			return $str;
	}
}

if(!function_exists(secure)) {
	function secure($str){
		// Case of an array
		if (is_array($str)) {
			foreach($str AS $id => $value) {
				$str[$id] = secure($value);
			}
		}
		else
			$str = vweb_sanitycheck($str);

		return $str;
	}
}

// Get Filter
$vweb_AI	= array_keys($_GET);
$i=0;
while($i<count($vweb_AI)) {
	$_GET[$vweb_AI[$i]]=secure($_GET[$vweb_AI[$i]]);
	$i++;
}


// Request Filter
$vweb_AI	= array_keys($_REQUEST);
$i=0;
while($i<count($vweb_AI)) {
	$_REQUEST[$vweb_AI[$i]]=secure($_REQUEST[$vweb_AI[$i]]);
	$i++;
}


// Post Filter
$vweb_AI	= array_keys($_POST);
$i=0;
while($i<count($vweb_AI)) {
	$_POST[$vweb_AI[$i]]=secure($_POST[$vweb_AI[$i]]);
	$i++;
}

// Cookie Filter 
$vweb_AI	= array_keys($_COOKIE);
$i=0;
while($i<count($vweb_AI)) {
	$_COOKIE[$vweb_AI[$i]]=secure($_COOKIE[$vweb_AI[$i]]);
	$i++;
}

$_REQUEST = clean_variable($_REQUEST);
$_POST = clean_variable($_POST);
$_GET = clean_variable($_GET);
$_COOKIE = clean_variable($_COOKIE);
$_SESSION = clean_variable($_SESSION);

foreach($_GET as $key => $val) { $_GET[$key] = antiinject_query($val); }
foreach($_POST as $key => $val) { $_POST[$key] = antiinject_query($val); }
foreach($_COOKIE as $key => $val) { $_COOKIE[$key] = antiinject_query($val); }
foreach($_REQUEST as $key => $val) { $_REQUEST[$key] = antiinject_query($val); }

check_inject();
?>