test.php
<?
error_reporting(E_ALL);
require_once("secureURL.php");
secureURL::initialize("password" , array("www.thefallenones.net/mw/test.php" , "test.php") , array('var'));
print_r($_GET);
?>
<br>
<a href=test.php?var=1&var2=2&var3=3&public=1>Hello</a> <br>
<a href=http://www.thefallenones.net/mw/test.php?var=1&var2=2&var3=3>Hello</a> <br>
<form action=test.php?form=1 method="POST">
Form : <input type=submit>
</form>
Here is the hardcore stuff
secureURL.php
<?
class secureURL
{
var $gz;
var $password;
var $filter;
var $params;
function initialize($password,$filter=null,$params=null,$gz=false,$auto_global=null)
{
global $secureURL;
$secureURL = new secureURL();
if ($filter !== null)
{
if (!is_array($filter)) $filter = array($filter);
foreach ($filter as $key => $var)
{
$filter[$key] = strtolower($var);
}
}
if (!is_array($params)) $params = array();
$secureURL->gz = $gz;
$secureURL->password = $password;
$secureURL->params = $params;
$secureURL->filter = $filter;
ob_start('secureURL_output');
if (@$_GET['crypt'] && @$_GET['hash'])
{
$_GET['crypt'] = secureURL::decrypt($_GET['crypt']);
if (secureURL::hash($_GET['crypt']) != @$_GET['hash'])
{
$_GET = array();
return;
}
$_GET['crypt'] = html_entity_decode($_GET['crypt'] , ENT_QUOTES);
parse_str($_GET['crypt'] , $_GET);
if ($auto_global === null) $auto_global = (ini_get("register_globals"));
if ($auto_global)
{
foreach ($_GET as $key => $var)
{
$GLOBALS[$key] = $var;
}
}
}
}
function crypt($string)
{
global $secureURL;
$password = $secureURL->password;
$i = 0;$j = 0;
for ($i = 0;$i < strlen($string);$i++)
{
$string[$i] = chr(ord($string[$i]) ^ ord($password[$j]));
$j++;
if ($j >= strlen($password)) $j = 0;
}
$string = base64_encode($string);
return $string;
}
function decrypt($string)
{
global $secureURL;
$string = base64_decode($string);
$password = $secureURL->password;
$i = 0;$j = 0;
for ($i = 0;$i < strlen($string);$i++)
{
$string[$i] = chr(ord($string[$i]) ^ ord($password[$j]));
$j++;
if ($j >= strlen($password)) $j = 0;
}
return $string;
}
function check_filter($url)
{
global $secureURL;
if ($secureURL->filter === null) return true;
$url = parse_url($url);
return in_array(($url['host'] ? $url['host'] : "") . $url['path'] , $secureURL->filter);
}
function hash($string)
{
return dechex(crc32(secureURL::crypt( (string) crc32($string))));
}
}
function secureURL_output($content)
{
global $secureURL;
$content = preg_replace_callback("/(href|src|action)=([\"'])(.*)\\2/Ui" , 'secureURL_encode' , $content);
$content = preg_replace_callback('/(href|src|action)=([^" \'>]*)/' , 'secureURL_encode2' , $content);
if ($secureURL->gz && function_exists())
{
$content = ob_gzhandler($content);
}
return $content;
}
function secureURL_encode2($matches)
{
global $secureURL;
$text = $matches[1] . "=";
if (strpos($matches[2] , "?") !== false && secureURL::check_filter($matches[2]))
{
$query = substr($matches[2],strpos($matches[2] , "?") + 1);
if (is_array($secureURL->params) && count($secureURL->params))
{
$params = array();
parse_str($query,$params);
$query2 = '';
foreach ($secureURL->params as $key)
{
if (isset($params[$key]))
{
$query2 .= "&$key=" . urlencode($params[$key]);
}
}
}
$query = "hash=" . secureURL::hash($query) . "&crypt=" . secureURL::crypt($query);
if (isset($query2)) $query .= $query2;
$matches[2] = substr($matches[2] , 0 , strpos($matches[2] , "?") + 1) . $query;
}
$text .= $matches[2];
return $text;
}
function secureURL_encode($matches)
{
global $secureURL;
$text = $matches[1] . "=" . $matches[2];
if (strpos($matches[3] , "?") !== false && secureURL::check_filter($matches[3]))
{
$query = substr($matches[3],strpos($matches[3] , "?") + 1);
if (is_array($secureURL->params) && count($secureURL->params))
{
$params = array();
parse_str($query,$params);
$query2 = '';
foreach ($secureURL->params as $key)
{
if (isset($params[$key]))
{
$query2 .= "&$key=" . urlencode($params[$key]);
}
}
}
$query = "hash=" . secureURL::hash($query) . "&crypt=" . secureURL::crypt($query);
if (isset($query2)) $query .= $query2;
$matches[3] = substr($matches[3] , 0 , strpos($matches[3] , "?") + 1) . $query;
}
$text .= $matches[3] . $matches[2];
return $text;
}
?>