archive/new-bigly-chat
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix XSS in forms

Browse source
This commit is contained in:
biglyderv 2024-12-07 07:12:42 -05:00
parent d6a6ce1ffc
commit 914350f69b
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
libs/form.php
View file

@ -2,24 +2,24 @@
function form($title, $form_message, $inputs, $action = '') { ?> function form($title, $form_message, $inputs, $action = '') { ?>
<form class='form' enctype="multipart/form-data" method="POST" action="<?php echo $action ?>"> <form class='form' enctype="multipart/form-data" method="POST" action="<?php echo $action ?>">
<h1 class="form-heading"> <h1 class="form-heading">
<?php echo $title ?> <?php echo htmlspecialchars($title) ?>
</h1> </h1>
<span class='form-message'> <span class='form-message'>
<?php echo $form_message ?> <?php echo htmlspecialchars($form_message) ?>
</span> </span>
<?php <?php
foreach ($inputs as $kv) { ?> foreach ($inputs as $kv) { ?>
<span class='form-key'> <span class='form-key'>
<?php echo $kv['key'] ?> <?php echo htmlspecialchars($kv['key']) ?>
</span> </span>
<<?php echo (($kv['type'] == 'textarea') ? 'textarea' : 'input') ?> <<?php echo (($kv['type'] == 'textarea') ? 'textarea' : 'input') ?>
class='form-input' class='form-input'
type="<?php echo $kv['type'] ?>" type="<?php echo htmlspecialchars($kv['type']) ?>"
name="<?php echo $kv['name'] ?>" name="<?php echo htmlspecialchars($kv['name']) ?>"
<?php echo ($kv['type'] == 'hidden') ? 'hidden' : ''?> <?php echo ($kv['type'] == 'hidden') ? 'hidden' : ''?>
value="<?php echo ($kv['type'] == 'textarea') ? '' : $kv['default'] ?>" value="<?php echo ($kv['type'] == 'textarea') ? '' : htmlspecialchars($kv['default']) ?>"
><?php echo (($kv['type'] == 'textarea') ? $kv['default'] . '</textarea>' : '') ?> ><?php echo (($kv['type'] == 'textarea') ? htmlspecialchars($kv['default']) . '</textarea>' : '') ?>
<?php } <?php }
?> ?>
<input class='form-button' type="Submit" name="Submit"> <input class='form-button' type="Submit" name="Submit">