sécuriser un formulaire

Bonsoir à tous,

techniquement je n'ai pas de soucis, mon progamme fonctionne. Mais j'ai l'impression d'avoir fait un 777 avec ce formulaire.

son rôle est simple, générer un fichier batch en fonction des chemins d'accés qu'il reçoit.

lors de la saise, une prévisualisation s'affiche.

un bouton télécharger permet de récupérer le programme formater

formulaire

<?php
require_once("./class2.php");
$sql = e107::getDb();
$mes = e107::getMessage();
require_once(HEADERF);
?>
<script type="text/javascript">
    document.title = "Générateur de sauvegarde";
</script>

<link rel="stylesheet"
      href="/e107_plugins/sc_tools/page/highlightjs/styles/dark.min.css">

<
<script defer="" src="https://highlightjs.org/static/highlight.min.js"></script>

<script defer="" src="https://highlightjs.org/static/demo/demo.js"></script>

<div>
    <form method="post" action="........./e107_plugins/sc_tools/page/request/autosav.php">

    <span class="element_form">
        <span style="color:white">Adresse du Launcher<br></span>
            <input type="text" name="launcher" id="launcher" style="width: 280px;" class="input_form"
                   placeholder="Où se trouve le launcher">
            <span class="glyphicon glyphicon-home glyphicon_form" aria-hidden="true"></span>
        <button type="button" data-toggle="modal" data-target="#launcher_box">?</button><br>
        <span style="color:#e0def4">ex: C:\Program Files\Roberts Space Industries\RSI Launcher</span>

        </span>

        <span class="element_form">
        <span style="color:white">Lieux de sauvegarde<br></span>
            <input type="text" id="sav" name="sav" style="width: 280px;" class="input_form"
                   placeholder="Où se trouve votre lieux de sauvegarde">
            <span class="glyphicon glyphicon-floppy-save glyphicon_form" aria-hidden="true"></span><button type="button"
                                                                                                           data-toggle="modal"
                                                                                                           data-target="#sav_box">?</button>
        <br>
        <span style="color:#e0def4">ex: c:\Users\moi\OneDrive\Bureau</span>

        </span>

        <span class="element_form">
            <span style="color:white">Adresse du jeux<br></span>
            <input type="text" id="game" name="game" style="width: 280px;" class="input_form"
                   placeholder="Où se trouve le live en lui même">
            <span class="glyphicon glyphicon-send glyphicon_form" aria-hidden="true"></span>
        <button type="button" data-toggle="modal" data-target="#game_box">?</button>
        <br>
        <span style="color:#e0def4">ex: I:\Starcitizen\StarCitizen</span>
        </span>

        <h3>Prévisuel du fichier</h3>

        <div id="req_result"></div>
        <input type="submit" value="Récupérer le fichie">
    </form>
</div>
<script>
    var launcher = "";
    var sav = "";
    var game = "";
     $('#launcher').keyup(delay(function (e) {
        // if(this.value =! "")
        // {
        launcher = (this.value);
        // }
        request();
    }, 1000));
    $('#sav').keyup(delay(function (e) {
        // if(this.value =! "")
        //  {
        sav = (this.value);
        //  }
        request();
    }, 1000));
    $('#game').keyup(delay(function (e) {
        //if(this.value =! "")
        //  {
        game = (this.value);
        console.log(this.value);
        //  }
        request();
    }, 1000));

    function delay(callback, ms) {
        var timer = 0;
        return function () {
            var context = this, args = arguments;
            clearTimeout(timer);
            timer = setTimeout(function () {
                callback.apply(context, args);
            }, ms || 0);
        };
    }

    function request() {
        var xmlhttp = new XMLHttpRequest();

        xmlhttp.open("POST", "......../e107_plugins/sc_tools/page/request/autosav.php", true);
        xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
        data = [];
        data['launcher'] = launcher;
        data['sav'] = sav;
        data['game'] = game;
        console.log(data);

        xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
        xmlhttp.onreadystatechange = function () {
            if (this.readyState == 4 && this.status == 200) {
                //console.log(this.responseText);
                document.getElementById("req_result").innerHTML = '<pre style="max-height: 400px"><div class="code language-dos" id="prg">' + this.responseText + '</div></pre>';
                document.querySelectorAll('div.code').forEach(el => {
                    // then highlight each
                    hljs.highlightElement(el);
                });

            }
        };
        xmlhttp.send("action=read&launcher=" + launcher + "&sav=" + sav + "&game=" + game);
    };

</script>

<?php
require_once(FOOTERF);
exit;
?>

traitement

<?php

$prg= "
echo off
::pensez à télécharger nircmd https://www.nirsoft.net/utils/nircmd.html
::https://www.nirsoft.net/utils/nircmd.zip

nircmd exec show " . $_POST['launcher'] . "\RSI Launcher.exe
timeout 5 > nul
cd " . $_POST['sav'] . "\
mkdir keybinding
cd " . $_POST['sav'] . "\keybinding

set /A run=2

:start

tasklist /fi \"ImageName eq RSI Launcher.exe\" /fo csv 2>NUL | find /I \"RSI Launcher.exe\">NUL
::echo etat de error level:%ERRORLEVEL%
if \"%ERRORLEVEL%\"==\"1\" (goto exit)
...";
if(!empty($_POST) and $_POST['sav']=!"" and $_POST['game']=!"" and $_POST['launcher']=!"" and $_POST['action'] !="")
    {
        if ($_POST['action'] === "read")
        {
                echo $prg;
        }
        else{
            header("Content-type: text/plain");
            header("Content-Disposition: attachment; filename=autosav.bat");

            // do your Db stuff here to get the content into $content
            print $prg;
            print $content;
        }
    }
else{

}

Je souhaitearai être que des injections soient impossible
n'appellant pas de BD ici, ça devrait être limité, mais...

pourriez vous me guider

Merci d'avance pour votre aide