$detectstart = time(); $val = $_SERVER['QUERY_STRING'].print_r($_POST,1); if (preg_match('/(\%27)|(\')|(\%23)/ix', $val)) $intru = 'SQL Injection attemp "sql meta-chars found in request"'; if (preg_match('/\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix', $val)) $intru = 'SQL Injection attemp "typical"'; if (preg_match('/((\%27)|(\')|( ))union/ix', $val)) $intru = 'SQL Injection attemp "union"'; if (strpos($val,'%3C%73%63%72%69%70%74%3E') !== false) $intru = 'Crosssite scripting attemp "HEX-encoded script-tag"'; if (!empty($intru)) { $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; if (empty($ip)) $ip = $_SERVER['REMOTE_ADDR']; $mail = "Getvars:\n"; ob_start(); print_r($_GET); $v = ob_get_contents(); ob_end_clean(); $mail .= $v; $mail .= "\n\n------------\n"; $mail .= "Postvars:\n"; ob_start(); print_r($_POST); $v = ob_get_contents(); ob_end_clean(); $mail .= $v; $mail .= "\n\n------------\n"; $mail .= "Sessionvars:\n"; $temp = $_SESSION; unset($temp[lastpage]); ob_start(); print_r($temp); $v = ob_get_contents(); ob_end_clean(); $mail .= $v; $mail .= "\n\n------------\n"; $mail .= "Servervars:\n"; ob_start(); print_r($_SERVER); $v = ob_get_contents(); ob_end_clean(); $mail .= $v; $mail .= "\n\n------------\n"; $mail .= "Analyzed string"; mail('mail@keenora.de', '*** '.$intru.' ***', $mail); exit; } unset($mail); unset($lcval); unset($val); ?>