From 1e84bc6f1ddd90a1cac806f17aeb2f7f35415b1d Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@gmail.com>
Date: Fri, 21 Mar 2014 10:18:47 +0900
Subject: [PATCH] =?UTF-8?q?blind=20sql=20injection=20=EB=8C=80=EC=9D=91=20?=
 =?UTF-8?q?=EC=BD=94=EB=93=9C=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 common.php         | 8 ++++----
 lib/common.lib.php | 8 +++++++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/common.php b/common.php
index abd7fc1d5..823f4f00c 100644
--- a/common.php
+++ b/common.php
@@ -80,10 +80,10 @@ if (file_exists($dbconfig_file)) {
     }
 
     // sql_escape_string 적용
-    $_POST    = array_map_deep('sql_escape_string', $_POST);
-    $_GET     = array_map_deep('sql_escape_string', $_GET);
-    $_COOKIE  = array_map_deep('sql_escape_string', $_COOKIE);
-    $_REQUEST = array_map_deep('sql_escape_string', $_REQUEST);
+    $_POST    = array_map_deep(G5_ESCAPE_FUNCTION,  $_POST);
+    $_GET     = array_map_deep(G5_ESCAPE_FUNCTION,  $_GET);
+    $_COOKIE  = array_map_deep(G5_ESCAPE_FUNCTION,  $_COOKIE);
+    $_REQUEST = array_map_deep(G5_ESCAPE_FUNCTION,  $_REQUEST);
     //==============================================================================
 
     // PHP 4.1.0 부터 지원됨
diff --git a/lib/common.lib.php b/lib/common.lib.php
index b884704cd..422d43ddc 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -1451,8 +1451,14 @@ function sql_select_db($db, $connect)
 // mysql_query 와 mysql_error 를 한꺼번에 처리
 function sql_query($sql, $error=G5_DISPLAY_SQL_ERROR)
 {
+    // Blind SQL Injection 취약점 해결
+    $sql = trim($sql);
+    // union의 사용을 허락하지 않습니다.
+    $sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql);
+    // `information_schema` DB로의 접근을 허락하지 않습니다.
+    $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);
     if ($error)
-        $result = @mysql_query($sql) or die("<p>$sql<p>" . mysql_errno() . " : " .  mysql_error() . "<p>error file : {$_SERVER['PHP_SELF']}");
+        $result = @mysql_query($sql) or die("<p>$sql<p>" . mysql_errno() . " : " .  mysql_error() . "<p>error file : $_SERVER[PHP_SELF]");
     else
         $result = @mysql_query($sql);
     return $result;