<?php
session_start();
$mystring = strtoupper($_SERVER['QUERY_STRING']);

$postvalues = $_REQUEST;
$returnurl = "";
$rootfolder = "";
$phpself = $_SERVER['PHP_SELF'];
if($phpself != ''){
$phpself_array = explode('/app/', $phpself);
if(count($phpself_array) > 0){
    $phpself_array = explode('/', $phpself_array[0]);
}

if(count($phpself_array) > 0){
    $rootfolder = $phpself_array[count($phpself_array) - 1];
}
$hosturl = $_SERVER['SERVER_NAME'];
$returnurl = 'http://'. $hosturl."/".$rootfolder;
}
 $redirectURL = $_SERVER['SCRIPT_URL'];

$refferBack = 0;
if(isset ($_SERVER['REDIRECT_SCRIPT_URL'])){
  
      if($redirectURL == '/'.$rootfolder.'/index.php' || $redirectURL == '/'.$rootfolder.'/' || $redirectURL == '' || $redirectURL =='/'.$rootfolder.'/admins/index' || $redirectURL =='/'.$rootfolder.'/admins/login'|| $redirectURL =='/'.$rootfolder.'/admins/'){
       $refferBack = 1;
     }
 }


//check user url
$userUrl = array('/categories/show_cat/',
                 '/products/show/',
                 '/carts/show/',
                 '/feedbacks/show/',
                 '/users/login',
                '/cmspages/aboutus',
                '/cmspages/faq'
    );

foreach ($userUrl as $key => $value) {

    if(strpos($redirectURL, $value) > 0){
        $refferBack = 1;break;
    }

}
 
//$refferBack = 1;

if(!isset ($_SERVER['HTTP_REFERER']) && $refferBack == 0){
    header('location:'.$returnurl);
    exit();
}
foreach($postvalues as $postval ){
     if(stripos($postval,"SELECT")> 0 || strpos($postval,"UNION") > 0){
        header('location:'.$returnurl);
	exit();
  }
   
}

$server_injec1=strpos($mystring, 'SELECT');
$server_injec2=strpos($mystring, 'UNION');

if (($server_injec1 === false) && ($server_injec2 === false) || ($server_injec1 === '0') && ($server_injec2 === '0')) 
{
	;
}//end if
else
{
	 header('location:'.$returnurl);
	exit();
}//end else
?>