Escape request and database values in forms and links.

Add form_value() in html.lib.php.
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
@@ -16,7 +16,7 @@ if ($queue) { ?>
 <p>To view articles in the queue, <a href="edit?queue=1">click here</a>.</p>
 <div class="input" style="text-align: justify">
        <form action="" method="get">
-  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?? '' ?>" />
+  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= form_value(get_search_args()) ?>" />
  <input name="queue" type="hidden" value="0" />
  <button type="submit" id="choose" name="action" value="choose" class="inputbutton">Search</button>
 </form>