Помогите пожалуйста с защитой SQL инъекция

kilk27855

Новичок
Помогите решить проблему где что экранировать
Код:
<?php
/**
 *
 * Uriy_Vasilev
 *
 */
if( ! defined( 'MK' ) ) die('ПОШЁЛ НАХУЙ ВАМ ЧТО НИБУДЬ ГОВОРИТ?');

$page    = (isset($_GET['page'])) ? intval($_GET['page']) : 1;
$num     = $page;
$perpage = $conf['perpage'];
$offset  = ($num-1) * $perpage;
$game    = (isset($_GET['game'])) ? name_filtered($_GET['game']) : 'all';
$all_game = type_list();
$type     = isset($all_game[$game]) ? 'where type=\''.$game.'\'' : 'where type!=\'type\'';
$status   = ($conf['offline_output']!='off') ? '' : 'and status=\'1\'';
$query    = 'SELECT * FROM `mk_list` '.$type.' '.$status;
$my       = $main->db->query('SELECT * FROM `mk_list` '.$type.' '.$status.' ORDER BY vip DESC, golos DESC LIMIT '.$offset.','.$perpage);
$i        = $offset;

if(!$main->db->num($my))
{
    $contents = '<center><b>'.preg_replace('/\{games\}/is', (($game!='all') ? type_list($game) : $lang['all_serv']), $lang['view_text10']).'</b></center>';
}
else
{
        $contents = '<div class="mainpage-info">
        <center><b>Добро пожаловать на SAMP-Monitorin.Ru - ТОП Рейтинг GTA SAMP серверов!</b></center>
        <center>Вы можете <a href="/addserv/" class="btn btn-warning">Добавить свой сервер</a> или <a href="/choose/" class="btn btn-warning">найти сервер</a> для игры.<br></center>
    
    </div><table class="table" style="background-color:#fff;">
         <tbody><tr bgcolor="grey" nowrap="">';

while ($rowmy=$main->db->fetch($my))
{
    $server=query_cached('', '', '', 'sec', $rowmy['id']);
    $cache=server_html($server);
    
    
    
    
    if($rowmy['steam'] == 1){
    $steam='<span class="label label-success">RP</span>';}
    else if($rowmy['steam'] == 2){
        $steam='<span class="label label-warning">RPG</span>';}
    else if($rowmy['steam'] == 3){
        $steam='<span class="label label-primary">DM</span>';}
    else if($rowmy['steam'] == 4){
        $steam='<span class="label label-primary">TDM</span>';}
    else if($rowmy['steam'] == 5){
        $steam='<span class="label label-info">Stunt</span>';}
    else{
        $steam='<span class="label">None</span>';}
    
    
    
    $color=($rowmy['line_col']) ? $rowmy['line_col'] : '#7e7e7e';
    $line=($rowmy['line']) ? ' bgcolor="'.$color.'"' : '';
    
    

    $version = ($cache['e']['version']) ?  $cache['e']['version'] : '-';
    
    $sname=substr($rowmy['sname'], 0, 55);

    
    $k=$i+1;
    $vote=($rowmy['vip'] > '0') ? '<i class="tpl-icon-rating"></i>' : '<span id="serv'.$rowmy['id'].'-layer">'.$rowmy['golos'].'</span><span style="cursor:pointer;
" onclick="vote('.$rowmy['id'].',\'up\',\''.$main->auth->username.'\');"> <span id="serv'.$rowmy['id'].'-button"><i class="icon-arrow-up"></i></span>';
    
    
    
    
    
    $rowmy['country'] = ($rowmy['country']=='') ? 'XX' : $rowmy['country'];
    
    $contents.= '
         <tr '.$line.' nowrap>
            <td align="center">'.$k.'</td>
            <td class="text9_color" nowrap >'.$steam.' <a href="'.(($conf['rewrite']=='on') ? '/server-'.$rowmy['id'].'' : 'index.php?do=view&n='.$rowmy['id']).'">'.$sname.'</a> </td>
            <td align="center"><a href="/go.php?url='.$rowmy['type'].'://'.$rowmy['ip'].':'.$rowmy['q_port'].'" title="Нажмите что бы играть. Версия: '.$version.'">'.$rowmy['ip'].':'.$rowmy['q_port'].'</a></td>
            <td align="center">'.$cache['s']['players'].'/'.$cache['s']['playersmax'].'</td>
            
            <td align="center">'.$vote.'</td>
        </tr>';
    $i++;
}
  $contents.= '</table><br><center>
';
  $numpages = ceil($main->db->num($main->db->query($query))/$perpage);
  $neighbours = 2;
  $left_neighbour = $page - $neighbours;
  if ($left_neighbour < 1) $left_neighbour = 1;
  $right_neighbour = $page + $neighbours;
  if ($right_neighbour > $numpages) $right_neighbour = $numpages;
  if ($numpages > 1)
  {
    if($page > 1)
    {
            $pre=$page-1;
            $contents.= ' <a class="btn" href="/'.(($conf['rewrite']=='on') ? 'game/'.$game.'/'.$pre.'/' : 'index.php?game='.$game.'&page='.$pre).'">«</a>';
    }
    if($page>$neighbours+1)
    {
            $contents.= ' <a  class="btn" href="/'.(($conf['rewrite']=='on') ? 'game/'.$game.'/' : 'index.php?game='.$game).'">1</a> ';
            $contents.= '... ';
    }
        for ($i=$left_neighbour; $i<=$right_neighbour; $i++)
    {
            $contents.= ($page==$i) ? ' <b><a class="btn btn-large disabled" href="" class="current">'.$i.'</a></b> </li>' : '<a class="btn" href="/'.(($conf['rewrite']=='on') ? 'game/'.$game.'/'.$i.'/' : 'index.php?game='.$game.'&page='.$i).'">'.$i.'</a>';
        }
    if($page<=$numpages-$neighbours-1)
    {
            $contents.= '... ';
            $contents.= ' <a class="btn" href="/'.(($conf['rewrite']=='on') ? 'game/'.$game.'/'.$numpages.'/' : 'index.php?game='.$game.'&page='.$numpages).'">'.$numpages.'</a>';
    }
        if($page<$numpages)
    {
            $next=$page+1;
            $contents.= ' <a class="btn" href="/'.(($conf['rewrite']=='on') ? 'game/'.$game.'/'.$next.'/' : 'index.php?game='.$game.'&page='.$next).'">»</a>';
        }
  $contents.= '<br><br>';
  }

   $contents.= '</center>';
}

$nav = ($game!='all') ? type_list($game) : " ТОП  Рейтинг GTA SAMP серверов";

?>
 
Сверху