cvs: phpweb / quickref.php search.php

jimw Fri Aug 31 03:59:17 2001 EDT Modified files: /phpweb search.php quickref.php Log: use htmlspecialchars when redisplaying search request Index: phpweb/search.php diff -u phpweb/search.php:1.17 phpweb/search.php:1.18 --- phpweb/search.php:1.17 Sun Jul 8 08:13:48 2001 +++ phpweb/search.php Fri Aug 31 03:59:17 2001 @@ -176,7 +176,7 @@ exit; } if ($result[2] == "NOMATCH") { - echo "Sorry, no documents matched your search for<b>&quot;".$pattern."&quot;</b>.<br><br>"; + echo "Sorry, no documents matched your search for<b>&quot;".htmlspecialchars($pattern)."&quot;</b>.<br><br>"; echo "Click here for a <a href=\"$sourceurl\">New Search</a><br><br>\n"; commonFooter(); exit; @@ -188,7 +188,7 @@ $pages = $result[6]; $baseurl = $PHP_SELF."?pattern=$words&show=$show&base=$base"; - echo "$matches documents match your search for '<b>$pattern</b>' in the $where:<br><br>\n"; + echo "$matches documents match your search for '<b>",htmlspecialchars($pattern),"</b>' in the $where:<br><br>\n"; echo "Click here for a <a href=\"$sourceurl\">New Search</a><br><br>\n"; makeBar($page,$pages,$baseurl,$firstdisplayed,$lastdisplayed); Index: phpweb/quickref.php diff -u phpweb/quickref.php:1.16 phpweb/quickref.php:1.17 --- phpweb/quickref.php:1.16 Thu Aug 16 05:13:29 2001 +++ phpweb/quickref.php Fri Aug 31 03:59:17 2001 @@ -68,11 +68,11 @@ <?php if ($notfound) { ?> <p> -Sorry, but the function <b><?php echo $notfound; ?></b> is not in the online manual. +Sorry, but the function <b><?php echo htmlspecialchars($notfound); ?></b> is not in the online manual. Perhaps you misspelled it, or it is a relatively new function that hasn't made it into the online documentation yet. The following are the <?php echo $SHOW_CLOSE; ?> functions which seem to be closest in spelling -to <b><?php echo $notfound; ?></b> (really good matches are in bold). Perhaps +to <b><?php echo htmlspecialchars($notfound); ?></b> (really good matches are in bold). Perhaps you were looking for one of these: </p> @@ -80,8 +80,8 @@ <p> If you want to search the entire PHP website for the string -&quot;<b><?php echo $notfound; ?></b>&quot;, then -<?php print_link('search.php?show=nosource&pattern='.urlencode($notfound), 'click here'); ?>. +&quot;<b><?php echo htmlspecialchars($notfound); ?></b>&quot;, then +<?php print_link('search.php?show=nosource&amp;pattern='.urlencode(htmlspecialchars($notfound)), 'click here'); ?>. </p> <p>