1
2
3
4

<?php
$domains = array();
$ref = $_SERVER['HTTP_REFERER'];
...

1
2
3

<?php if (the_ID() == 8) { ?>
...

1
2
3

<?php 
echo (the_ID() == 8) ? '<div id="menu_show" class="slideshow"><img src="http://example.org/image.gif" alt="A picture" width="748" height="245" /></div>':'<div class="header"></div>';
?>

1
2
3
4

<?php

$flacpath = '/bin/flac';
...

1
2
3
4

<?php
echo '<select name="options">';
foreach(array("option1", "option2", "option3") as $i){
...

1
2
3
4

	$proveedores = consulta("SELECT * FROM proveedores ORDER BY Nombre");
	while ($fila = mysql_fetch_assoc($proveedores))
		$proveedores_list[$fila['id']]= $fila['Nombre'];
...

1
2
3
4

<?php
$username = (isset($_POST['username'])) ? $_POST['username'] : (isset($_SESSION['username'])) ? $_SESSION['username'] : 'Username';

...

1
2
3
4

<?php
$username = (isset($_POST['username'])) ? $_POST['username'] : (isset($_SESSION['username'])) ? $_SESSION['username'] : 'Username';
?>
...

1
2
3
4

<?php
function has( var , default ) {
  if( isset( $_POST[var] )
...

1
2
3

If you use this code, you can no longer insert those strings into a DB, unless you want corrupted data, or unless you manually unescape them before doing so.

A nicer approach is to wrap the strings in a class, like SecureString, and have methods like toHtml(), toSql(), getRaw(), etc.

1
2
3
4

function random_password($length = 6)
{
  return substr( md5(microtime()),0, $length);
...

1
2
3
4

<?php

if (preg_match('#^[a-z0-9]$#Di', $_GET['n']))
...