// JavaScript Document
function get_all_form_element(formName)
{

	var totFormObj = document.forms;
	var formObj = null;
	
	for(var i=0; i<totFormObj.length; i++)
	{
		if (totFormObj[i].name == formName)
		{
			formObj = totFormObj[i];
		}
	}
	
	if(formObj == null)
	{
		return true;
	}
	else
	{
		var num_of_elements = formObj.length;
		var ctr = 0;
		var formElements = new Array();
		for(var j=0; j<num_of_elements; j++)
		{
			if(formObj.elements[j]!=null)
			{		
				if(formObj.elements[j].type=="text" || formObj.elements[j].type=="textarea" || formObj.elements[j].type=="hidden")
				{
					if(!validateInput(formObj.elements[j]))
					{
						return false;
						break;
					}
				}
			}						
		}
	}
	
	return true;
}
//-------------------------------------------------------------------------------------------
function get_all_form(formObj)
{

	var num_of_elements = formObj.length;
	var ctr = 0;
	var formElements = new Array();
	for(var j=0; j<num_of_elements; j++)
	{
		if(formObj.elements[j]!=null)
		{
			if(formObj.elements[j].type=="text" || formObj.elements[j].type=="textarea" || formObj.elements[j].type=="hidden")
			{
				if(!validateInput(formObj.elements[j]))
				{
					return false;
					break;
				}
			}
		}						
	}

	return true;
}
//-------------------------------------------------------------------------------------------
function validateInput(textObj)
{

	var objTxt,txtValue,pattern;

	removeSpace(textObj);
	if(validateSQLSyntax(textObj))
	{			  
		if (validateHTML(textObj))
		{			  
		  return true;
		}
	}
	return false;
}

function validateHTML(textObj)
{
	var i,j,txtValue;
	var blackList = new Array("<applet>","<body>","<embed>","<frame>","<script>","<frameset>","<html>","<iframe>","<style>","<layer>","<link>","<ilayer>","<meta>","<object>","<applet","<body","<embed","<frame","<script","<frameset","<html","<iframe","<style","<layer","<link","<ilayer","<meta","<object","vbscript","msgbox");
   	txtValue = textObj.value;
	txtValue = txtValue.replace(/&gt;/g,">").replace(/&lt;/g,"<");
   	for (i=0;i<blackList.length;i++)
   	{
	  	j=txtValue.indexOf(blackList[i]);
	  	if(j>-1)
	  	{
			return false;
	  	}
   	}
   	return true;
}

function removeSpace(textObj)
{
	var i, txtValue, txtLength;

	txtValue = textObj.value;
	txtLength = txtValue.length;

	for (i=0; i<txtLength;i++)
	{
		if (txtValue.charAt(i) == " " && txtValue.charAt(i+1) == " " )
		{
			txtValue = txtValue.substring(0,i+1) + txtValue.substr(i+2);  
			i--;
		}
	}

	textObj.value = txtValue;
}

function validateSQLSyntax(textObj)
{
	var strToTest = textObj.value;
	var regex1=/\b(update)\s([a-z,0-9]+[.])*([a-z,0-9]+)\s(set)\b/gi;
	var regex2=/\b(select)\s([a-z0-9_]+[.])*([a-z0-9_]+)+\s(from)\b/gi;
	var regex3=/\b(select)\s*([a-z0-9_]+[.])*\*([,]+[a-z0-9_]+[.]+\*)*([,]+[a-z0-9_])*\s*\b(from)\b/gi;	
	var regex4=/\b(drop)\s(table|schema|database|trigger|type|function|procedure|package|sequence|view|index|public synonym)+\b/gi;
	var regex5=/\b(alter)\s(table|schema|database|trigger|type|function|procedure|package|sequence|view|index|session)+\b/gi;
	var regex6=/\b(create)\s(or replace|table|schema|database|trigger|type|function|procedure|package|sequence|view|index|session)+\b/gi;
	var regex7=/\b(insert)\s(into|all into)+\b/gi;
	var regex8=/\b(delete)\s(from)\b/gi;
	var regex9=/\b(exec|execute)\b\s([a-z,0-9]+[.])*([a-z,0-9]+[(]+[a-z,0-9]+[)])*[;]*/gi;
	var regex10=/\b(truncate)\s(table)\b/gi;
	var regex11=/([.]js)\b/i; 
	
	var objRegExp1 = new RegExp(regex1);
	var objRegExp2 = new RegExp(regex2);
	var objRegExp3 = new RegExp(regex3);
	var objRegExp4 = new RegExp(regex4);
	var objRegExp5 = new RegExp(regex5);
	var objRegExp6 = new RegExp(regex6);
	var objRegExp7 = new RegExp(regex7);
	var objRegExp8 = new RegExp(regex8);
	var objRegExp9 = new RegExp(regex9);
	var objRegExp10 = new RegExp(regex10);
	var objRegExp11 = new RegExp(regex11);

	if(objRegExp1.test(strToTest) || objRegExp2.test(strToTest) || objRegExp3.test(strToTest)|| objRegExp4.test(strToTest)|| objRegExp5.test(strToTest)|| objRegExp6.test(strToTest)|| objRegExp7.test(strToTest)|| objRegExp8.test(strToTest)|| objRegExp9.test(strToTest)||objRegExp10.test(strToTest)||objRegExp11.test(strToTest))
	{
		return false;
	} 
	return true;
} 