From bf19cd8bf5f54fce002489c7dd53bb00a295ecc9 Mon Sep 17 00:00:00 2001 From: thisgun Date: Mon, 30 Mar 2026 11:03:16 +0000 Subject: [PATCH] =?UTF-8?q?[KVE-2026-0568]=EC=98=81=EC=B9=B4=ED=8A=B8=20SQ?= =?UTF-8?q?L=20Injection=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?= =?UTF-8?q?=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- mobile/shop/orderformupdate.php | 28 ++++++++++++++-------------- shop/orderformupdate.php | 28 ++++++++++++++-------------- 2 files changed, 28 insertions(+), 28 deletions(-) diff --git a/mobile/shop/orderformupdate.php b/mobile/shop/orderformupdate.php index d28e1f2c6..1bdcd5ff4 100644 --- a/mobile/shop/orderformupdate.php +++ b/mobile/shop/orderformupdate.php @@ -594,25 +594,25 @@ if($default['de_tax_flag_use']) { } $od_email = get_email_address($od_email); -$od_name = clean_xss_tags($od_name); -$od_tel = clean_xss_tags($od_tel); -$od_hp = clean_xss_tags($od_hp); +$od_name = addslashes(clean_xss_tags(stripslashes($od_name))); +$od_tel = addslashes(clean_xss_tags(stripslashes($od_tel))); +$od_hp = addslashes(clean_xss_tags(stripslashes($od_hp))); $od_zip = preg_replace('/[^0-9]/', '', $od_zip); $od_zip1 = substr($od_zip, 0, 3); $od_zip2 = substr($od_zip, 3); -$od_addr1 = clean_xss_tags($od_addr1); -$od_addr2 = clean_xss_tags($od_addr2); -$od_addr3 = clean_xss_tags($od_addr3); +$od_addr1 = addslashes(clean_xss_tags(stripslashes($od_addr1))); +$od_addr2 = addslashes(clean_xss_tags(stripslashes($od_addr2))); +$od_addr3 = addslashes(clean_xss_tags(stripslashes($od_addr3))); $od_addr_jibeon = preg_match("/^(N|R)$/", $od_addr_jibeon) ? $od_addr_jibeon : ''; -$od_b_name = clean_xss_tags($od_b_name); -$od_b_tel = clean_xss_tags($od_b_tel); -$od_b_hp = clean_xss_tags($od_b_hp); -$od_b_addr1 = clean_xss_tags($od_b_addr1); -$od_b_addr2 = clean_xss_tags($od_b_addr2); -$od_b_addr3 = clean_xss_tags($od_b_addr3); +$od_b_name = addslashes(clean_xss_tags(stripslashes($od_b_name))); +$od_b_tel = addslashes(clean_xss_tags(stripslashes($od_b_tel))); +$od_b_hp = addslashes(clean_xss_tags(stripslashes($od_b_hp))); +$od_b_addr1 = addslashes(clean_xss_tags(stripslashes($od_b_addr1))); +$od_b_addr2 = addslashes(clean_xss_tags(stripslashes($od_b_addr2))); +$od_b_addr3 = addslashes(clean_xss_tags(stripslashes($od_b_addr3))); $od_b_addr_jibeon = preg_match("/^(N|R)$/", $od_b_addr_jibeon) ? $od_b_addr_jibeon : ''; -$od_memo = clean_xss_tags($od_memo, 0, 1, 0, 0); -$od_deposit_name = clean_xss_tags($od_deposit_name); +$od_memo = addslashes(clean_xss_tags(stripslashes($od_memo), 0, 1, 0, 0)); +$od_deposit_name = addslashes(clean_xss_tags(stripslashes($od_deposit_name))); $od_tax_flag = $default['de_tax_flag_use']; // 주문서에 입력 diff --git a/shop/orderformupdate.php b/shop/orderformupdate.php index 13d737a9f..b3d091420 100644 --- a/shop/orderformupdate.php +++ b/shop/orderformupdate.php @@ -557,25 +557,25 @@ if($default['de_tax_flag_use']) { } $od_email = get_email_address($od_email); -$od_name = clean_xss_tags($od_name); -$od_tel = clean_xss_tags($od_tel); -$od_hp = clean_xss_tags($od_hp); +$od_name = addslashes(clean_xss_tags(stripslashes($od_name))); +$od_tel = addslashes(clean_xss_tags(stripslashes($od_tel))); +$od_hp = addslashes(clean_xss_tags(stripslashes($od_hp))); $od_zip = preg_replace('/[^0-9]/', '', $od_zip); $od_zip1 = substr($od_zip, 0, 3); $od_zip2 = substr($od_zip, 3); -$od_addr1 = clean_xss_tags($od_addr1); -$od_addr2 = clean_xss_tags($od_addr2); -$od_addr3 = clean_xss_tags($od_addr3); +$od_addr1 = addslashes(clean_xss_tags(stripslashes($od_addr1))); +$od_addr2 = addslashes(clean_xss_tags(stripslashes($od_addr2))); +$od_addr3 = addslashes(clean_xss_tags(stripslashes($od_addr3))); $od_addr_jibeon = preg_match("/^(N|R)$/", $od_addr_jibeon) ? $od_addr_jibeon : ''; -$od_b_name = clean_xss_tags($od_b_name); -$od_b_tel = clean_xss_tags($od_b_tel); -$od_b_hp = clean_xss_tags($od_b_hp); -$od_b_addr1 = clean_xss_tags($od_b_addr1); -$od_b_addr2 = clean_xss_tags($od_b_addr2); -$od_b_addr3 = clean_xss_tags($od_b_addr3); +$od_b_name = addslashes(clean_xss_tags(stripslashes($od_b_name))); +$od_b_tel = addslashes(clean_xss_tags(stripslashes($od_b_tel))); +$od_b_hp = addslashes(clean_xss_tags(stripslashes($od_b_hp))); +$od_b_addr1 = addslashes(clean_xss_tags(stripslashes($od_b_addr1))); +$od_b_addr2 = addslashes(clean_xss_tags(stripslashes($od_b_addr2))); +$od_b_addr3 = addslashes(clean_xss_tags(stripslashes($od_b_addr3))); $od_b_addr_jibeon = preg_match("/^(N|R)$/", $od_b_addr_jibeon) ? $od_b_addr_jibeon : ''; -$od_memo = clean_xss_tags($od_memo, 1, 1, 0, 0); -$od_deposit_name = clean_xss_tags($od_deposit_name); +$od_memo = addslashes(clean_xss_tags(stripslashes($od_memo), 1, 1, 0, 0)); +$od_deposit_name = addslashes(clean_xss_tags(stripslashes($od_deposit_name))); $od_tax_flag = $default['de_tax_flag_use']; // 주문서에 입력