From 914350f69b3e7816ae9b98ece621101740a54fbf Mon Sep 17 00:00:00 2001
From: biglyderv <eggseggsarecool+git@gmail.com>
Date: Sat, 7 Dec 2024 07:12:42 -0500
Subject: [PATCH] fix XSS in forms

---
 libs/form.php | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/libs/form.php b/libs/form.php
index 0b51280..84e89e9 100755
--- a/libs/form.php
+++ b/libs/form.php
@@ -2,24 +2,24 @@
     function form($title, $form_message, $inputs, $action = '') { ?>
         <form class='form' enctype="multipart/form-data" method="POST" action="<?php echo $action ?>">
             <h1 class="form-heading">
-                <?php echo $title ?>
+                <?php echo htmlspecialchars($title) ?>
             </h1>
             <span class='form-message'>
-                <?php echo $form_message ?>
+                <?php echo htmlspecialchars($form_message) ?>
             </span>
             <?php
                 foreach ($inputs as $kv) { ?>
                     <span class='form-key'>
-                        <?php echo $kv['key'] ?>
+                        <?php echo htmlspecialchars($kv['key']) ?>
                     </span>
                     
                     <<?php echo (($kv['type'] == 'textarea') ? 'textarea' : 'input') ?>
                         class='form-input' 
-                        type="<?php echo $kv['type'] ?>"
-                        name="<?php echo $kv['name'] ?>" 
+                        type="<?php echo htmlspecialchars($kv['type']) ?>"
+                        name="<?php echo htmlspecialchars($kv['name']) ?>" 
 						<?php echo ($kv['type'] == 'hidden') ? 'hidden' : ''?>
-                        value="<?php echo ($kv['type'] == 'textarea') ? '' : $kv['default'] ?>"
-                    ><?php echo (($kv['type'] == 'textarea') ? $kv['default'] . '</textarea>' : '') ?>
+                        value="<?php echo ($kv['type'] == 'textarea') ? '' : htmlspecialchars($kv['default']) ?>"
+                    ><?php echo (($kv['type'] == 'textarea') ? htmlspecialchars($kv['default']) . '</textarea>' : '') ?>
                 <?php }
             ?>
             <input class='form-button' type="Submit" name="Submit">