From ab79139a913be6f1c881381e843eb9de2c40db40 Mon Sep 17 00:00:00 2001
From: chicpro <chicpro@sir.co.kr>
Date: Thu, 10 Dec 2015 16:12:20 +0900
Subject: [PATCH] =?UTF-8?q?=ED=95=84=ED=84=B0=EB=A7=81=20=EC=BD=94?=
 =?UTF-8?q?=EB=93=9C=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 shop/cartoption.php          |  3 ++-
 shop/itemoption.php          | 10 ++++++----
 shop/ordercoupon.php         |  2 +-
 shop/orderitemcoupon.php     |  3 ++-
 shop/ordersendcostcoupon.php |  4 ++--
 5 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/shop/cartoption.php b/shop/cartoption.php
index a0a37e7eb..d1a89f5d7 100644
--- a/shop/cartoption.php
+++ b/shop/cartoption.php
@@ -1,7 +1,8 @@
 <?php
 include_once('./_common.php');
 
-$it_id = $_POST['it_id'];
+$pattern = '#[/\'\"%=*\#\(\)\|\+\&\!\$~\{\}\[\]`;:\?\^\,]#i';
+$it_id  = preg_replace($pattern, '', $_POST['it_id']);
 
 $sql = " select * from {$g5['g5_shop_item_table']} where it_id = '$it_id' and it_use = '1' ";
 $it = sql_fetch($sql);
diff --git a/shop/itemoption.php b/shop/itemoption.php
index 0ffe287eb..6e7c44fe3 100644
--- a/shop/itemoption.php
+++ b/shop/itemoption.php
@@ -1,10 +1,12 @@
 <?php
 include_once('./_common.php');
 
-$it_id = $_POST['it_id'];
-$opt_id = $_POST['opt_id'];
-$idx = $_POST['idx'];
-$sel_count = $_POST['sel_count'];
+$pattern = '#[/\'\"%=*\#\(\)\|\+\&\!\$~\{\}\[\]`;:\?\^\,]#i';
+
+$it_id  = preg_replace($pattern, '', $_POST['it_id']);
+$opt_id = preg_replace($pattern, '', $_POST['opt_id']);
+$idx    = preg_replace('#[^0-9]#', '', $_POST['idx']);
+$sel_count = preg_replace('#[^0-9]#', '', $_POST['sel_count']);
 
 $sql = " select * from {$g5['g5_shop_item_option_table']}
                 where io_type = '0'
diff --git a/shop/ordercoupon.php b/shop/ordercoupon.php
index c85acda20..2fc43311b 100644
--- a/shop/ordercoupon.php
+++ b/shop/ordercoupon.php
@@ -4,7 +4,7 @@ include_once('./_common.php');
 if($is_guest)
     exit;
 
-$price = (int)$_POST['price'];
+$price = (int)preg_replace('#[^0-9]#', '', $_POST['price']);
 
 if($price <= 0)
     die('상품금액이 0원이므로 쿠폰을 사용할 수 없습니다.');
diff --git a/shop/orderitemcoupon.php b/shop/orderitemcoupon.php
index 099de59d0..d28f5d61a 100644
--- a/shop/orderitemcoupon.php
+++ b/shop/orderitemcoupon.php
@@ -5,7 +5,8 @@ if($is_guest)
     exit;
 
 // 상품정보
-$it_id = $_POST['it_id'];
+$pattern = '#[/\'\"%=*\#\(\)\|\+\&\!\$~\{\}\[\]`;:\?\^\,]#i';
+$it_id  = preg_replace($pattern, '', $_POST['it_id']);
 $sw_direct = $_POST['sw_direct'];
 $sql = " select it_id, ca_id, ca_id2, ca_id3 from {$g5['g5_shop_item_table']} where it_id = '$it_id' ";
 $it = sql_fetch($sql);
diff --git a/shop/ordersendcostcoupon.php b/shop/ordersendcostcoupon.php
index 4d4a2c14f..4e16bf5a5 100644
--- a/shop/ordersendcostcoupon.php
+++ b/shop/ordersendcostcoupon.php
@@ -4,8 +4,8 @@ include_once('./_common.php');
 if($is_guest)
     exit;
 
-$price = $_POST['price'];
-$send_cost = $_POST['send_cost'];
+$price = preg_replace('#[^0-9]#', '', $_POST['price']);
+$send_cost = preg_replace('#[^0-9]#', '', $_POST['send_cost']);
 
 // 쿠폰정보
 $sql = " select *