Index: /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/mp_db.php
===================================================================
--- /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/mp_db.php	(revision 20314)
+++ /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/mp_db.php	(working copy)
@@ -4,7 +4,29 @@
 use \DOMDocument;
 include "db_config.php";
 
-function SerializerIntoXml($data,$rootName) {
+function check_dbname($site_name)
+{
+	$pattern = '/^([0-9]|[a-z]|[A-Z]|[-_])+$/';
+	if (preg_match($pattern, $site_name)) {
+		return true;
+	} else {
+		return false;
+	}
+}
+
+function sanity_check_name($name)
+{
+	$invalid_str = "\"'`";
+	for($i=0; $i < strlen($invalid_str); $i++) {
+		$in_char = substr($invalid_str, $i, 1);
+		if (strpos($name, $in_char) !== false) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function SerializerIntoXml($data, $rootName, $sitename) {
 	$xml;
 	if($rootName == 'Rules'){
 		$xmlstring = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" . "<Rules>";
Index: /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_app.php
===================================================================
--- /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_app.php	(revision 20316)
+++ /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_app.php	(working copy)
@@ -1,15 +1,15 @@
 <?php
 include_once "mp_db.php";
 include_once "mp_portal_config.php";
-require_once "aproxy_cli.php";
 $sitename = $_COOKIE["site_name"];
 if(!$sitename){
 	error_log("site_name is null!");
 	exit("site_name is null!");
-}
-if(!check_sitename($sitename)) {
-    error_log("site_name is invalid!");
-    exit("site_name is invalid!");
+} else {
+	if(!MP\DB\check_dbname($sitename)) {
+		error_log("site_name is invalid!");
+		exit("site_name is invalid!");
+	}
 }
 $dbname = "auth_" . $sitename;
 $db_conn = new MP\DB\MP_db($dbname);
@@ -18,11 +18,21 @@
 if(!$user_name){
 	error_log("<$sitename> user_name is null!");
 	exit("user_name is null!");
+} else {
+	if(!MP\DB\sanity_check_name($user_name)) {
+		error_log("<$sitename> user_name is invalid!");
+		exit("user_name is invalid!");
+	}
 }
 $groups = $_COOKIE["roles"];
 if(!$groups){
 	error_log("<$sitename> roles is null!");
 	exit("roles is null!");
+} else {
+	if(!MP\DB\sanity_check_name($groups)) {
+		error_log("<$sitename> role is invalid!");
+		exit("role is invalid!");
+	}
 }
 $groups = explode(',', $groups);
 
@@ -91,7 +101,7 @@
 	error_log("<$sitename> query external mdm setting failed!");
 }
 $host->portal = get_mp_portal_config($sitename);
-echo MP\DB\SerializerIntoXml($host,'Host');
+echo MP\DB\SerializerIntoXml($host, 'Host', $sitename);
 
 function app_existed($app, $app_collection) {
 	return MP\DB\resource_existed($app, $app_collection);
Index: /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_cv.php
===================================================================
--- /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_cv.php	(revision 20316)
+++ /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_cv.php	(working copy)
@@ -1,20 +1,26 @@
 <?php
 include_once "mp_db.php";
-require_once "aproxy_cli.php";
 $sitename = $_COOKIE["site_name"];
 if(!$sitename){
 	error_log("site_name is null!");
 	exit("site_name is null!");
+} else {
+	if(!MP\DB\check_dbname($sitename)) {
+		error_log("site_name is invalid!");
+		exit("site_name is invalid!");
+	}
 }
-if(!check_sitename($sitename)) {
-    error_log("site_name is invalid!");
-    exit("site_name is invalid!");
-}
+
 $dbname = "auth_" . $sitename;
 $user_name = $_COOKIE["user_name"];
 if(!$user_name){
         error_log("<$sitename> user_name is null!");
         exit("user_name is null!");
+} else {
+        if(!MP\DB\sanity_check_name($user_name)) {
+            error_log("<$sitename> user_name is invalid!");
+            exit("user_name is invalid!");
+        }
 }
 $db_conn = new MP\DB\mp_db($dbname);
 
@@ -22,9 +28,9 @@
 $res = $db_conn->queryRuleByUser($user_name);
 header("Content-Type: application/xml");
 if($res) {
-	$rules->rules = $res;
+        $rules->rules = $res;
 } else {
-	error_log("<$sitename> query clv rule by user failed! user is: " . $user_name);
+        error_log("<$sitename> query clv rule by user failed! user is: " . $user_name);
 }
 $groups = $db_conn->queryGroupByUser($user_name);
 while(list($key,$group)= each($groups)) {
@@ -39,7 +45,7 @@
 		}
 	}
 }
-echo MP\DB\SerializerIntoXml($rules,'Rules');
+echo MP\DB\SerializerIntoXml($rules,'Rules', $sitename);
 
 function rule_existed($rule, $rule_collection) {
 	return MP\DB\resource_existed($rule, $rule_collection);
Index: /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_getdesc.php
===================================================================
--- /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_getdesc.php	(revision 20314)
+++ /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/postlogin_getdesc.php	(working copy)
@@ -4,12 +4,23 @@
 if(!$sitename){
 	error_log("site_name is null!");
 	exit("site_name is null!");
+} else {
+	if(!MP\DB\check_dbname($sitename)) {
+		error_log("site_name is invalid!");
+		exit("site_name is invalid!");
+	}
 }
+
 $dbname = "auth_" . $sitename;
 $db_conn = new MP\DB\MP_db($dbname);
 $host = new MP\DB\Host('Host');
 $url = parse_url($_SERVER["REQUEST_URI"]);
 $path = $url["path"];
+if(!MP\DB\sanity_check_name($path)) {
+	error_log("<$sitename> path is invalid!");
+	exit("path is invalid!");
+}
+
 $uri = explode('/', $path);
 $packageName=$uri[4];
 
@@ -22,5 +33,5 @@
 	error_log("<$sitename> query appstore failed! Package name is:" . $packageName);
 }
 
-echo MP\DB\SerializerIntoXml($host,'Host');
+echo MP\DB\SerializerIntoXml($host, 'Host', $sitename);
 ?>
Index: /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/prelogin_cv.php
===================================================================
--- /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/prelogin_cv.php	(revision 20314)
+++ /branches/rel_ag_9_4_5/aproxy/apps/webapp/motionpro/prelogin_cv.php	(working copy)
@@ -4,7 +4,13 @@
 if(!$sitename){
 	error_log("site_name is null!");
 	exit("site_name is null");
+} else {
+	if(!MP\DB\check_dbname($sitename)) {
+		error_log("site_name is invalid!");
+		exit("site_name is invalid!");
+	}
 }
+
 $dbname = "auth_" . $sitename;
 $db_conn = new MP\DB\mp_db($dbname);
 
@@ -17,5 +23,5 @@
 	error_log("<$sitename> query clv rule by instance failed!");
 }
 
-echo MP\DB\SerializerIntoXml($rules,'Rules');
+echo MP\DB\SerializerIntoXml($rules, 'Rules', $sitename);
 ?>
\ No newline at end of file