Changeset 9db57c5 in github

Timestamp:

Oct 31, 2005 6:47:03 PM (8 years ago)

Author:

thomascube <thomas@…>

Branches:

master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8

Children:

dba5f7c

Parents:

7cc38e0

Message:

Prevent from address book XSS

File:

• program/steps/addressbook/save.inc (modified) (2 diffs)

program/steps/addressbook/save.inc

@@ -35 +35 @@
       continue;
     
-    $a_write_sql[] = sprintf("%s='%s'", $col, addslashes($_POST[$fname]));
+    $a_write_sql[] = sprintf("%s='%s'", $col, addslashes(strip_tags($_POST[$fname])));
     }
 
@@ -104 +104 @@
     
     $a_insert_cols[] = $col;
-    $a_insert_values[] = sprintf("'%s'", addslashes($_POST[$fname]));
+    $a_insert_values[] = sprintf("'%s'", addslashes(strip_tags($_POST[$fname])));
     }