[boggseric]

Originally Posted by VBDev

I have used stangger5 fix but was getting the reported issue with stristr on a customer forum.

I did the below edit, code will do the same and is simpler.

In arcade.php search for the ibp_cleansql function, search for

PHP Code:

// remove any SQL-commands 


Add below :

PHP Code:

$sqlcomm = array(); 


Then search for :

PHP Code:

$value = recursive_str_ireplace($sqlcomm, '', $value); 


Comment it out :

PHP Code:

// $value = recursive_str_ireplace($sqlcomm, '', $value); 


Add after :

PHP Code:

    foreach ($sqlcomm AS $key => $needle)
    {
        $value = str_ireplace($needle, '', $value);
    } 


That does the same but is fairly simpler...

Though I must admit that Mrz fixed the 2.7.1 security issue rather uglily...
That bit of code could remove actual correct content ...

I made these changes but now there error moved down one line.

Fatal error: Call to undefined function: str_ireplace() in /home/ls2com/public_html/forums/arcade.php on line 5601


2.7.2 does it now required PHP5?

my code in arcade.php

// remove any SQL-commands
	$sqlcomm = array();
	$sqlcomm[] = 'create';
	$sqlcomm[] = 'database';
	$sqlcomm[] = 'table';
	$sqlcomm[] = 'insert';
	$sqlcomm[] = 'update';
	$sqlcomm[] = 'rename';
	$sqlcomm[] = 'replace';
	$sqlcomm[] = 'select';
	$sqlcomm[] = 'handler';
	$sqlcomm[] = 'delete';
	$sqlcomm[] = 'truncate';
	$sqlcomm[] = 'drop';
	$sqlcomm[] = 'where';
	$sqlcomm[] = 'or';
	$sqlcomm[] = 'and';
	$sqlcomm[] = 'values';
	$sqlcomm[] = 'set';
	$sqlcomm[] = 'password';
	$sqlcomm[] = 'salt';
	$sqlcomm[] = 'concat';
	$sqlcomm[] = 'schema';
	// $value = recursive_str_ireplace($sqlcomm, '', $value);
	foreach ($sqlcomm AS $key => $needle) 
    { 
        $value = str_ireplace($needle, '', $value); 
    }