Escape request and database values in forms and links.

Add form_value() in html.lib.php.
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
@@ -79,7 +79,7 @@ if ($denied)
  echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>

-<form action="<?php echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
+<form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
  <div class="grid">

    <label for="username">Username: </label>