svn: /web/php-master/trunk/manage/ users.php
| From: | Ferenc Kovacs | Date: | Sun, 24 Jul 2011 18:25:26 +0000 |
| Subject: | svn: /web/php-master/trunk/manage/ users.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-11754@lists.php.net to get a copy of this message | ||
tyrael Sun, 24 Jul 2011 18:25:26 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=313652
Log:
fix an xss vuln
Changed paths:
U web/php-master/trunk/manage/users.php
Modified: web/php-master/trunk/manage/users.php
===================================================================
--- web/php-master/trunk/manage/users.php 2011-07-24 18:18:59 UTC (rev 313651)
+++ web/php-master/trunk/manage/users.php 2011-07-24 18:25:26 UTC (rev 313652)
@@ -159,7 +159,7 @@
}
if(strlen($in['purpose'])) {
- $purpose = addslashes($in['purpose']);
+ $purpose = htmlspecialchars($in['purpose'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO users_note (userid, note, entered) VALUES ($id,
'$purpose', NOW())";
db_query($query);
}
@@ -310,7 +310,7 @@
$res = db_query("SELECT note, UNIX_TIMESTAMP(entered) AS ts FROM users_note WHERE
userid=$id");
echo "<b>notes</b>";
while ($res && $row = mysql_fetch_assoc($res)) {
- echo "<div>", date("r",$row['ts']), "<br
/>{$row['note']}</div>";
+ echo "<div>", date("r",$row['ts']), "<br
/>".htmlspecialchars($row['note'], ENT_QUOTES,
'UTF-8')."</div>";
}
}
foot();