<?php
define('LOG_PATH', "log");

class MrGETClean {

	function queryWalk($queryString, $forbiddenSymbols, $allowableParams, $scriptURL) {

		$flag = false;

		$queryFragments		= array();
		$queryArr		= array();
		$cleanedQueryFragments	= array();

		$queryFragments = explode("&", $queryString);

		foreach ($queryFragments as $key => $value) {
			$queryArr[$key]['p'] = substr($value, 0, strpos($value, '='));
			$queryArr[$key]['v'] = substr($value, strpos($value, '=') + 1);
		}

		foreach ($queryArr as $key => $value) {	
			if (!in_array($queryArr[$key]['p'], $allowableParams)) {				
				$queryArr[$key] = null;
				$flag = true;
			}

			foreach ($forbiddenSymbols as $symbol) {
				if (stristr($queryArr[$key]['v'], $symbol)) {
					$queryArr[$key] = null;
					$flag = true;
				}
			}
		}		

		foreach ($queryArr as $key => $value) {
			if ($queryArr[$key]['p'] != null) {
				$cleanedQueryFragments[$key] = $queryArr[$key]['p'] . "=" . $queryArr[$key]['v'];
			}
		}

		if ($flag) {
			$this->MrGETCleanMakeLog($queryString, $scriptURL);		
		}

		$queryString = implode("&", $cleanedQueryFragments);
		
		return $queryString;
		
	}

	function MrGETCleanMakeLog($queryString, $scriptURL) {
		
		$date = date ("d-m-Y @ H:i:s");
		$log = LOG_PATH . "/log.txt";
		$handle = fopen($log,"a+" );
		fputs ($handle, 'Attack Date: ' . $date . 
			' | Attacker IP: ' . $this->getIP() . 
			' | Query: ' . htmlentities(urldecode($queryString)) .
			' | Script: ' . $scriptURL . "\r\n");
		fclose($handle);

	}

	function getIP() {

		$IP = '';

		if (isset($_SERVER)) {
			if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
				$IP = $_SERVER['HTTP_X_FORWARDED_FOR'];
			}
				elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
					$IP = $_SERVER['HTTP_CLIENT_IP'];
				}
					else {
						$IP = $_SERVER['REMOTE_ADDR'];
					}
		}
			else {
				if (getenv('HTTP_X_FORWARDED_FOR'))	{
					$IP = getenv('HTTP_X_FORWARDED_FOR');
				}
					elseif (getenv('HTTP_CLIENT_IP')) {
						$IP = getenv( 'HTTP_CLIENT_IP' );
					}
						else {
							$IP = getenv('REMOTE_ADDR');
						}
			}

		return $IP;

	}

}

?>