Foro de elhacker.net

[img] http://hackmexg.byethost33.com/game.php?page=logout[/img]

 [img]http://r.i.elhacker.net/cache?url=http://hackmexg.byethost33.com/game.php?page=logout[/img]

[img]http://r.i.elhacker.net/cache?url=http://[font= onerror=foo() tr=][/font][/img]

Se puede inutilizar una cuenta modificando algunos campos con valores incorrectos, por ejemplo los campos de ordenación en el panel de opciones.

	private function imagefix($img)
	{
		if(substr($img, 0, 7) != 'http://' or (substr($img, -4, 4) != '.png' and substr($img, -4, 4) != '.jpg'))
		{
			//$img = $img . './images/';
                        $img = 'Ingrese solo formatos "Jpg" ó "Png"';
		}
		return '<img src="' . $img . '" alt="' . $img . '" title="' . $img . '" />';
	}

function BBCode($string) {
	$string = trim($string);

	// BBCode [code]
	if (!function_exists('escape')) {
		function escape($s) {
			global $string;
			$string = strip_tags($string);
			$code = $s[1];
			$code = htmlspecialchars($code);
			$code = str_replace("[", "[", $code);
			$code = str_replace("]", "]", $code);
			return '<pre><code>'.$code.'</code></pre>';
		}	
	}
	$string = preg_replace_callback('/\[code\](.*?)\[\/code\]/ms', "escape", $string);

	// Smileys to find...
	$in = array( 	 ':)', 	
					 ':D',
					 ':o',
					 ':p',
					 ':(',
					 ';)'
	);
	// And replace them by...
	$out = array(	 '<img alt=":)" src="'.EMOTICONS_DIR.'emoticon-happy.png" />',
					 '<img alt=":D" src="'.EMOTICONS_DIR.'emoticon-smile.png" />',
					 '<img alt=":o" src="'.EMOTICONS_DIR.'emoticon-surprised.png" />',
					 '<img alt=":p" src="'.EMOTICONS_DIR.'emoticon-tongue.png" />',
					 '<img alt=":(" src="'.EMOTICONS_DIR.'emoticon-unhappy.png" />',
					 '<img alt=";)" src="'.EMOTICONS_DIR.'emoticon-wink.png" />'
	);
	$string = str_replace($in, $out, $string);
	
	// BBCode to find...
	$in = array( 	 '/\[b\](.*?)\[\/b\]/ms',	
					 '/\[i\](.*?)\[\/i\]/ms',
					 '/\[u\](.*?)\[\/u\]/ms',
					 '/\[img\](.*?)\[\/img\]/ms',
					 '/\[email\](.*?)\[\/email\]/ms',
					 '/\[url\="?(.*?)"?\](.*?)\[\/url\]/ms',
					 '/\[size\="?(.*?)"?\](.*?)\[\/size\]/ms',
					 '/\[color\="?(.*?)"?\](.*?)\[\/color\]/ms',
					 '/\[quote](.*?)\[\/quote\]/ms',
					 '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
					 '/\[list\](.*?)\[\/list\]/ms',
                                         '/\[font=(.*?)\](.*?)\[\/font\]/ms',
					 '/\[\*\]\s?(.*?)\n/ms'
	);
	// And replace them by...
	$out = array(	 '<strong>\1</strong>',
					 '<em>\1</em>',
					 '<u>\1</u>',
					 '<img src="\1" alt="\1" />',
					 '<a href="mailto:\1">\1</a>',
					 '<a href="\1">\2</a>',
					 '<span style="font-size:\1%">\2</span>',
					 '<span style="color:\1">\2</span>',
					 '<blockquote>\1</blockquote>',
					 '<ol start="\1">\2</ol>',
					 '<ul>\1</ul>',
                                         '<span style="font-family:\1">\2</span>',
					 '<li>\1</li>'
	);
	$string = preg_replace($in, $out, $string);
		
	// paragraphs
	$string = str_replace("\r", "", $string);
	$string = "<p>".preg_replace("/(\n){2,}/", "</p><p>", $string)."</p>";
	$string = nl2br($string);
	
	// clean some tags to remain strict
	// not very elegant, but it works. No time to do better ;)
	if (!function_exists('removeBr')) {
		function removeBr($s) {
			return str_replace("<br />", "", $s[0]);
		}
	}	
	$string = preg_replace_callback('/<pre>(.*?)<\/pre>/ms', "removeBr", $string);
	$string = preg_replace('/<p><pre>(.*?)<\/pre><\/p>/ms', "<pre>\\1</pre>", $string);
	
	$string = preg_replace_callback('/<ul>(.*?)<\/ul>/ms', "removeBr", $string);
	$string = preg_replace('/<p><ul>(.*?)<\/ul><\/p>/ms', "<ul>\\1</ul>", $string);
	
	return $string;
}