GET and POST tag checks

[StinkFinger]

All,
I have some code in a standard Nuke install. This code is in mainfile.php
which is included in every file. Is this preventing injections ? Is there a
better way to write this code ? I am trying to make sense of it all.

Should the same eregi expressions be added to the POST loop as well. I do
not need ANY tags to be submitted from the user at all.

foreach ($_GET as $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("\.\.", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue))) {
Header("Location: index.php");
die();
}
}

foreach ($_POST as $secvalue) {
if (eregi("<[^>]*script*\"?[^>]*>", $secvalue)) {
header("Location: index.php");
die();
}
}

Many thanks.

[Garp]

"StinkFinger" <st****@pinky.com> wrote in message
news:10*************@corp.supernews.com...

All,
I have some code in a standard Nuke install. This code is in mainfile.php
which is included in every file. Is this preventing injections ? Is there a better way to write this code ? I am trying to make sense of it all.

Should the same eregi expressions be added to the POST loop as well. I do
not need ANY tags to be submitted from the user at all.

foreach ($_GET as $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("\.\.", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue))) {
Header("Location: index.php");
die();
}
}

foreach ($_POST as $secvalue) {
if (eregi("<[^>]*script*\"?[^>]*>", $secvalue)) {
header("Location: index.php");
die();
}
}

Many thanks.

First, use $_REQUEST instead - it's basically both $_GET and $_PUT merged
together.

As for tags, just pass it through htmlspecialchars() and/or strip_tags() to
make it fully textual.

Garp