From a7604e02c4f9036069d44814542445c9a2a04f09 Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@gmail.com>
Date: Wed, 19 Feb 2014 08:58:45 +0900
Subject: [PATCH] =?UTF-8?q?mysql=5Freal=5Fescape=5Fstring=20=ED=95=A8?=
 =?UTF-8?q?=EC=88=98=20=EC=A0=81=EC=9A=A9=20=EC=BD=94=EB=93=9C=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 common.php         | 54 +++++++++++++++++++++-------------------------
 lib/common.lib.php | 18 ++++++++++++++++
 2 files changed, 42 insertions(+), 30 deletions(-)

diff --git a/common.php b/common.php
index a1c2fa1a1..3f8a74a56 100644
--- a/common.php
+++ b/common.php
@@ -11,30 +11,6 @@ if (!defined('G5_SET_TIME_LIMIT')) define('G5_SET_TIME_LIMIT', 0);
 @set_time_limit(G5_SET_TIME_LIMIT);
 
 
-//==============================================================================
-// php.ini 의 magic_quotes_gpc 값이 Off 인 경우 addslashes() 적용
-// SQL Injection 등으로 부터 보호
-// http://kr.php.net/manual/en/function.get-magic-quotes-gpc.php#97783
-//------------------------------------------------------------------------------
-if (!get_magic_quotes_gpc()) {
-    $escape_function = 'addslashes($value)';
-    $addslashes_deep = create_function('&$value, $fn', '
-        if (is_string($value)) {
-            $value = ' . $escape_function . ';
-        } else if (is_array($value)) {
-            foreach ($value as &$v) $fn($v, $fn);
-        }
-    ');
-
-    // Escape data
-    $addslashes_deep($_POST, $addslashes_deep);
-    $addslashes_deep($_GET, $addslashes_deep);
-    $addslashes_deep($_COOKIE, $addslashes_deep);
-    $addslashes_deep($_REQUEST, $addslashes_deep);
-}
-//==============================================================================
-
-
 //==========================================================================================================================
 // extract($_GET); 명령으로 인해 page.php?_POST[var1]=data1&_POST[var2]=data2 와 같은 코드가 _POST 변수로 사용되는 것을 막음
 // 081029 : letsgolee 님께서 도움 주셨습니다.
@@ -49,12 +25,6 @@ for ($i=0; $i<$ext_cnt; $i++) {
 }
 //==========================================================================================================================
 
-// PHP 4.1.0 부터 지원됨
-// php.ini 의 register_globals=off 일 경우
-@extract($_GET);
-@extract($_POST);
-@extract($_SERVER);
-
 // 완두콩님이 알려주신 보안관련 오류 수정
 // $member 에 값을 직접 넘길 수 있음
 $config = array();
@@ -97,6 +67,30 @@ if (file_exists($dbconfig_file)) {
     @mysql_query(" set names utf8 ");
     if(defined('G5_MYSQL_SET_MODE') && G5_MYSQL_SET_MODE) @mysql_query("SET SESSION sql_mode = ''");
     if (defined(G5_TIMEZONE)) @mysql_query(" set time_zone = '".G5_TIMEZONE."'");
+
+    //==============================================================================
+    // SQL Injection 등으로 부터 보호를 위해 mysql_real_escape_string() 적용
+    //------------------------------------------------------------------------------
+    // magic_quotes_gpc 에 의한 backslashes 제거
+    if (get_magic_quotes_gpc()) {
+        $_POST    = array_map_deep('stripslashes', $_POST);
+        $_GET     = array_map_deep('stripslashes', $_GET);
+        $_COOKIE  = array_map_deep('stripslashes', $_COOKIE);
+        $_REQUEST = array_map_deep('stripslashes', $_REQUEST);
+    }
+
+    // mysql_real_escape_string 적용
+    $_POST    = array_map_deep('mysql_real_escape_string', $_POST);
+    $_GET     = array_map_deep('mysql_real_escape_string', $_GET);
+    $_COOKIE  = array_map_deep('mysql_real_escape_string', $_COOKIE);
+    $_REQUEST = array_map_deep('mysql_real_escape_string', $_REQUEST);
+    //==============================================================================
+
+    // PHP 4.1.0 부터 지원됨
+    // php.ini 의 register_globals=off 일 경우
+    @extract($_GET);
+    @extract($_POST);
+    @extract($_SERVER);
 } else {
 ?>
 
diff --git a/lib/common.lib.php b/lib/common.lib.php
index e22a53413..8f70a6a34 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -7,6 +7,24 @@ if (!defined('_GNUBOARD_')) exit;
 **
 *************************************************************************/
 
+// multi-dimensional array에 사용자지정 함수적용
+function array_map_deep($fn, $array)
+{
+    if(is_array($array)) {
+        foreach($array as $key => $value) {
+            if(is_array($value)) {
+                $array[$key] = array_map_deep($fn, $value);
+            } else {
+                $array[$key] = call_user_func($fn, $value);
+            }
+        }
+    } else {
+        $array = call_user_func($fn, $array);
+    }
+
+    return $array;
+}
+
 // 마이크로 타임을 얻어 계산 형식으로 만듦
 function get_microtime()
 {