<?php
/*
Var Object
By Tran Anh Dung
Email: <a href="mailto:chiro8x@gmail.com">chiro8x@gmail.com</a>
Mobile: +84 974 431 568
-----------------------------------

$ = new var_object
*/
class var_object{
	
	private $cheatf;
	
//Sql injection noobs lol
	private $sqlinject = array("union select",
		") values (",
		"table_name",
		"information_schemal",
		"column_name",
		"version()",
		"@@version",
		"concat(",
		" and mid(");

//Sql injection smart
	private $sqlbeat = array("--",
		"'",
		"`",
		"(",
		")",
		"union",
		"select",
		"/*",
		"*/",
		"_name",
		"0x",
		"#",
		";",
		"insert",
		"into",
		"hex",
		"sha1",
		"concat",
		"_schemal",
		"null",
		"!32302",
		"select if",
		"+",
		"char",
		"load_file",
		"limit",
		"order",
		"where",
		"by",
		"benchmark",
		"=",
		"not",
		"or",
		"and");

//Found this
	public function found($haystack, $needle, $offset = NULL){
		
		if(!strpos(strtolower($haystack), strtolower($needle))){
			return false;
		}else{
			return true;
		}
		
	}

//Check sql injection
	public function check($value){
		
		$tmp = urlencode($value);
		
		if($this->found($tmp, "%00")){
			
			return false;
			
		}else{
			
			$final = false;
			$i = 0;
			$c = 0;
			//Noob check 
			while($final == false && $i < count($this->sqlinject)){
				$final = $this->found($value, $this->sqlinject[$i]);
				$i++;
			}
			
			//Smart check 
			if($final == false){
				for($i = 0; $i < count($this->sqlbeat); $i++){
					$times = substr_count(strtolower($value), strtolower($this->sqlbeat[$i]));
					if($times > 0 )$c += $times * strlen($this->sqlbeat[$i]);
				}
				if($c/strlen($value) > 0.4) $final = true;
			}

			return !$final;
			
		}
		
	}

//Data from GET request
	public function get($feild, &$value){
		
		if(isset($_GET[$feild])){
			
			return true;
			
		}else{
			
			if($this->check($_GET[$feild])){
				$value = $_GET[$feild];
				return true;
			}else{
				return false;
			}
			
		}
		
	}

//Data from POST request
	public function post($feild, &$value){
		
		if(isset($_POST[$feild])){
			
			return true;
			
		}else{
			
			if($this->check($_GET[$feild])){
				$value = $_POST[$feild];
				return true;
			}else{
				return false;
			}
			
		}
		
	}
	
}
?>

<?php
$demo = new var_object;

if($demo->get("id",$tmp)){ //$_GET['id']
	echo $tmp;
}else{
	echo "error !";
}
?>

function getEscaped( $text, $extra = false ) {
	$string = mysqli_real_escape_string( $this->_resource, $text );
	if ($extra) {
		$string = addcslashes( $string, '%_' );
	}
	return $string;
}

$q = "INSERT INTO table_name VALUES ('".getEscaped($value)."')";