$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\.\/\s]/", "", $_SERVER[$outside]): '';$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\:\@\.\/\s]/", "", $_SERVER[$outside]): ''; 
MODX Staff
// secure variables from outside
// added 03-05-06
foreach(array('HTTP_REFERER','HTTP_USER_AGENT') as $outside) {
$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\.\/\s]/", "", $_SERVER[$outside]): '';
if(strlen($_SERVER[$outside])>255) $_SERVER[$outside] = substr(0,255,$_SERVER[$outside]);
}
if(isset($_GET['q'])) $_GET['q'] = preg_replace("/[^A-Za-z0-9_\-\.\/]/", "", $_GET['q']);
But we find three anomalies: First, when the page is first invoked, $_SERVER[’HTTP_REFERER’] has no query string attached to the URL.If you invoke the page directly by typing an url $_SERVER[’HTTP_REFERER’]is null, this is normal because there is no page you come from.
Second, when we click a link that takes us to a second page within the website $_SERVER[’HTTP_REFERER’] contains the query string that was intended for the first page.I guess this is normal too, $_SERVER[’HTTP_REFERER’] contain the url of the page you are coming from, if you are in index.html and click a link to mypage.html, in mypage.html the $_SERVER[’HTTP_REFERER’] contains mypage.html.
all the punctuation (particularly "&" and "=") have been stripped out, leaving the names and values all jammed together with no delimiters.If you want to check the variable use: $GET[’my_var_name’]
$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\.\/\s]/", "", $_SERVER[$outside]): '';$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\:\@\.\?\&\/\s]/", "", $_SERVER[$outside]): '';