Update shorten.php

Escape user input in an attempt to prevent stored XSS when an admin views links.
azlux · Feb 15, 2020 · 08efde0 · 08efde0
1 parent 9d3905e
commit 08efde0
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/shorten.php b/shorten.php
@@ -109,9 +109,9 @@ function short($connexion, $username, $url, $custom, $comment) {
         exit();
     }
 
-    $url = $_POST['url'];
-    $comment = (!empty($_POST['comment'])) ? $_POST['comment'] : NULL;
-    $custom = (!empty($_POST['custom'])) ? $_POST['custom'] : NULL;
+    $url = htmlspecialchars(strip_tags($_POST['url']));
+    $comment = (!empty($_POST['comment'])) ? htmlspecialchars(strip_tags($_POST['comment'])) : NULL;
+    $custom = (!empty($_POST['custom'])) ? htmlspecialchars(strip_tags($_POST['custom'])) : NULL;
     $url_shortened = short($connexion, $username, $url, $custom, $comment);
 }
 include 'inc/header.php';