//Scan the GET array for malicious code
$log = "";

$closure = function($key,$l) use($rule_id, $rule_name, &$closure,&$log)
{
  if(is_array($l))
  {
    foreach($l as $subkey=>$subl)
    {
      $closure($subkey,$subl);
    }
    return;
  }
  $jinput = JFactory::getApplication()->input;
  //Filter for eval + base64decode.
  if(preg_match('/\beval\b\s*(.*)\(\s*base64_decode/i',$l))
  {
    //This is bad. Found eval key word followed by base64_decode.
    $log = 'Posted variable '.$key.' matched eval + base64_decode pattern in rule with id:'.$rule_id;
    unset($_POST[$key]);
    $jinput->set($key,null);
    return;
  }
  
  //Filter for eval($scope), where scope would be $_POST, $_GET, $_COOKIE, $_SERVER.
  if(preg_match('/\beval\b\s*(.*)\(\s*(\$_GET|\$_POST|\$_REQUEST|\$_COOKIE|\$_SERVER)/i',$l))
  {
    $log = 'Posted variable '.$key.' matched eval(*scope*) pattern in rule with id:'.$rule_id;
    unset($_POST[$key]);
    $jinput->set($key,null);
    return;
  }
  
  //Filter for document.write + iframe pattern.
  if(preg_match('/document\.write\s*(.*)iframe/i',$l))
  {
    $log = 'Posted variable '.$key.' matched document.write + iframe pattern in rule with id:'.$rule_id;
    unset($_POST[$key]);
    $jinput->set($key,null);
    return;
  }
  
  //Filter for echo, iframe and visibility in the same variable.
  if(stripos($l,'visibility') !== FALSE AND stripos($l,'echo') !== FALSE AND stripos($l,'iframe') !== FALSE)
  {
    $log = 'Posted variable '.$key.' matched echo, iframe and visibility pattern in rule with id:'.$rule_id;
    unset($_POST[$key]);
    $jinput->set($key,null);
    return;
  }
//Filter for SQL injections.
if(preg_match("/((%27)|')\s*(s|%73|%53)(e|%65|%45)(l|%6C|%4C)(e|%65|%45)(c|%63|%43)(t|%74|%54)/ix",$l))
{
	$log = 'Posted variable '.$key.' matched SQL injection pattern in rule with id:'.$rule_id;
	unset($_POST[$key]);
	$jinput->set($key,null);
	return;
}

if(preg_match("/\w*((%27)|')\s*(o|(%6F)|(%4F))(r|(%72)|(%52))/ix",$l))
{
	$log = 'Posted variable '.$key.' matched SQL injection pattern in rule with id:'.$rule_id;
	unset($_POST[$key]);
	$jinput->set($key,null);
	return;
}

if(preg_match("/((%27)|')\s*(u|%75|%55)(n|%6E|%4E)(i|%69|%49)(o|%6F|%4F)(n|%6E|%4E)/ix",$l))
{
	$log = 'Posted variable '.$key.' matched SQL injection pattern in rule with id:'.$rule_id;
	unset($_POST[$key]);
	$jinput->set($key,null);
	return;
}

if(preg_match("/((%27)|')\s*(d|%64|%44)(e|%65|%45)(l|%6C|%4C)(e|%65|%45)(t|%74|%54)(e|%65|%45)/ix",$l))
{
	$log = 'Posted variable '.$key.' matched SQL injection pattern in rule with id:'.$rule_id;
	unset($_POST[$key]);
	$jinput->set($key,null);
	return;
}


if(preg_match("/(union).*(select|update|delete).*(from)/ix",$l))
{
	$log = 'Posted variable '.$key.' matched SQL injection pattern in rule with id:'.$rule_id;
	unset($_POST[$key]);
	$jinput->set($key,null);
	return;
}


};

foreach($_POST as $key=>$l)
{
  $closure($key,$l);
  if(strlen($log) > 0){ $this->add_log($log,'standard'); $log = "";}
}