tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Escape request and database values in forms and links.

Browse Source 
Add form_value() in html.lib.php.
This commit is contained in:
tim
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
navigation.lib.php
+9 -9
View File
@@ -32,10 +32,10 @@ function sort_options($link) {
array_push($options, $display);
} else {
$href = '<a href="'.$link.'?sort='.$sort_key.'&amp;order='.$order_key;
if (isset($_GET['queue'])) $href .= '&amp;queue='.$_GET['queue'];
if (isset($_GET['queue'])) $href .= '&amp;queue='.($queue ? 1 : 0);
if (isset($_GET['search'])) $href .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['start'])) $href .= '&amp;start='.$start;
if (isset($_GET['show'])) $href .= '&amp;show='.$show;
if (isset($_GET['start'])) $href .= '&amp;start='.(int)$start;
if (isset($_GET['show'])) $href .= '&amp;show='.(int)$show;
$href .= '">'.$display.'</a>';
array_push($options, $href);
@@ -69,13 +69,13 @@ function get_pager() {
// Are there later stories? Go backwards to them
$string .= '<span class="next">';
if ($start > 0) {
$string .= "\n".'<a href="'.$link.'?start='.$next;
$string .= "\n".'<a href="'.$link.'?start='.(int)$next;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['show'])) $string .= '&amp;show='.(int)$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
$string .= '">&laquo; Next '.$articles.'</a>';
}
$string .= "</span>\n";
@@ -83,13 +83,13 @@ function get_pager() {
// Are there earlier stories? Go forwards to them
$string .= "\n".'<span class="prev">';
if ($prev < get_count()) {
$string .= "\n".'<a href="'.$link.'?start='.$prev;
$string .= "\n".'<a href="'.$link.'?start='.(int)$prev;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['show'])) $string .= '&amp;show='.(int)$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
$string .= '">Previous '.$articles.' &raquo;</a>';
}
$string .= "</span>\n";