<?php
//Anti SQLi (SQL Injection)
$array = array(
    "union",
    "sql",
    "mysql",
    "database",
    "cookie",
    "coockie",
    "select",
    "from",
    "where",
    "benchmark",
    "concat",
    "table",
    "into",
    "by",
    "values",
    "exec",
    "shell",
    "truncate",
    "wget",
    "/**/"
);
foreach ($array as $d) {
    $string = security($_SERVER['QUERY_STRING']);
    if (strpos(strtolower($string), $d) !== false) {
        $ip         = $_SERVER['REMOTE_ADDR'];
        $loc        = $_SERVER['PHP_SELF'];
        $browseros  = $_SERVER['HTTP_USER_AGENT'];
        $oslanguage = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
        $date       = date("d.m.Y / H:i:s");
        $file       = security('' . $loc . '?' . $string . '');
        $type       = "SQL Injection";
        $queryvalid = mysql_query("SELECT * FROM `hacker-attacks` WHERE file='$file' and type='SQL Injection' LIMIT 1");
        @$validator = mysql_num_rows($queryvalid);
        if ($validator > "0") {
            echo '<meta http-equiv="refresh" content="0;url=pages/blocked.php" />';
            exit();
        } else {
            $log    = "INSERT INTO `hacker-attacks` (ip, date, file, type, browseros, oslanguage) VALUES ('$ip', '$date', '$file', '$type', '$browseros', '$oslanguage')";
            $result = mysql_query($log);
            echo '<meta http-equiv="refresh" content="0;url=pages/blocked.php" />';
            exit();
        }
    }
}

//Anti Proxy
$proxy_headers = array(
    'HTTP_VIA',
    'HTTP_X_FORWARDED_FOR',
    'HTTP_FORWARDED_FOR',
    'HTTP_X_FORWARDED',
    'HTTP_FORWARDED',
    'HTTP_CLIENT_IP',
    'HTTP_FORWARDED_FOR_IP',
    'VIA',
    'X_FORWARDED_FOR',
    'FORWARDED_FOR',
    'X_FORWARDED',
    'FORWARDED',
    'CLIENT_IP',
    'FORWARDED_FOR_IP',
    'HTTP_PROXY_CONNECTION',
    'HTTP_PC_REMOTE_ADDR',
    'HTTP_X_IMFORWARDS',
    'HTTP_XROXY_CONNECTION'
);
foreach ($proxy_headers as $proxy_header) {
    if (isset($_SERVER[$proxy_header])) {
        $ip          = $_SERVER['REMOTE_ADDR'];
        $browseros   = $_SERVER['HTTP_USER_AGENT'];
        $oslanguage  = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
        $date        = date("d.m.Y / H:i:s");
        $type        = "Proxy";
        $queryvalid2 = mysql_query("SELECT * FROM `hacker-attacks` WHERE ip='$ip' and type='Proxy' LIMIT 1");
        $validator2  = mysql_num_rows($queryvalid2);
        if ($validator2 > "0") {
            echo '<meta http-equiv="refresh" content="0;url=pages/proxy.php" />';
            exit();
        } else {
            $log2    = "INSERT INTO `hacker-attacks` (ip, date, type, browseros, oslanguage) VALUES ('$ip', '$date', '$type', '$browseros', '$oslanguage')";
            $result2 = mysql_query($log2);
            echo '<meta http-equiv="refresh" content="0;url=pages/proxy.php" />';
            exit();
        }
    }
}

//Anti XSS (Cross-site Scripting)
function security($input)
{
    $input = mysql_real_escape_string($input);
    $input = strip_tags($input);
    $input = stripslashes($input);
    return $input;
}

//Anti DDoS (Distributed Denial of Service Attacks)
if (!isset($_SESSION)) {
    session_start();
}
if ($_SESSION['last_session_request'] > time() - 2) {
    $ip          = $_SERVER['REMOTE_ADDR'];
    $browseros   = $_SERVER['HTTP_USER_AGENT'];
    $oslanguage  = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
    $date        = date("d.m.Y / H:i:s");
    $type        = "DDoS";
    $queryvalid3 = mysql_query("SELECT * FROM `hacker-attacks` WHERE ip='$ip' and type='DDoS' LIMIT 1");
    $validator3  = mysql_num_rows($queryvalid3);
    if ($validator3 > "0") {
        echo '<meta http-equiv="refresh" content="0;url=pages/ddos.php" />';
        exit();
    } else {
        $log3    = "INSERT INTO `hacker-attacks` (ip, date, type, browseros, oslanguage) VALUES ('$ip', '$date', '$type', '$browseros', '$oslanguage')";
        $result3 = mysql_query($log3);
        echo '<meta http-equiv="refresh" content="0;url=pages/ddos.php" />';
        exit();
    }
}
$_SESSION['last_session_request'] = time();

//DNSBL Spam Security
$ip           = $_SERVER['REMOTE_ADDR'];
$browseros    = $_SERVER['HTTP_USER_AGENT'];
$oslanguage   = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
$date         = date("d.m.Y / H:i:s");
$type         = "Spam";
$dnsbl_lookup = array(
    //"dnsbl.solid.net",
    "dnsbl-1.uceprotect.net",
    "dnsbl-2.uceprotect.net",
    "dnsbl-3.uceprotect.net",
    "dnsbl.dronebl.org",
    "dnsbl.sorbs.net",
    "zen.spamhaus.org"
);
$reverse_ip   = implode(".", array_reverse(explode(".", $ip)));
foreach ($dnsbl_lookup as $host) {
    if (checkdnsrr($reverse_ip . "." . $host . ".", "A")) {
        $queryvalid4 = mysql_query("SELECT * FROM `hacker-attacks` WHERE ip='$ip' and type='Spam' LIMIT 1");
        $validator4  = mysql_num_rows($queryvalid4);
        if ($validator4 > "0") {
            echo '<meta http-equiv="refresh" content="0;url=pages/spam.php" />';
            exit();
        } else {
            $log4    = "INSERT INTO `hacker-attacks` (ip, date, type, browseros, oslanguage) VALUES ('$ip', '$date', '$type', '$browseros', '$oslanguage')";
            $result4 = mysql_query($log4);
            echo '<meta http-equiv="refresh" content="0;url=pages/spam.php" />';
            exit();
        }
    }
}

//Ban System
$guestip     = $_SERVER['REMOTE_ADDR'];
$querybanned = mysql_query("SELECT * FROM `bans` WHERE ip='$guestip'");
$banned      = mysql_num_rows($querybanned);
$row         = mysql_fetch_array($querybanned);
if ($banned > "0") {
    echo '<meta http-equiv="refresh" content="0;url=pages/banned.php" />';
}
?>