Escape request and database values in forms and links.

Add form_value() in html.lib.php.
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
@@ -1,11 +1,7 @@
 <?php
 require_once('open_db.lib.php');
 require_once(__DIR__ . '/lib/purify.inc.php');
-
-// Escape plain text for HTML (existing entities such as &hellip; are kept)
-function h($string) {
-  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
-}
+require_once(__DIR__ . '/html.lib.php');

 function display_stories($id = NULL) {
  global $db, $is_admin, $editable, $action;