From f78fd097102ea444d3de1286e7b0147583101d27 Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Fri, 25 Sep 2026 22:11:03 +0200
Subject: [PATCH] Accept only whole numbers for start and show, and cap show at
 50.

---
 get_data.lib.php | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/get_data.lib.php b/get_data.lib.php
index c0a17d8..f6302ce 100644
--- a/get_data.lib.php
+++ b/get_data.lib.php
@@ -292,29 +292,34 @@ function get_sort_arg() {
   return $sort;
 }
   
+// The most stories that one page can show
+define('MAX_SHOW', 50);
+
+// Return a whole number from the query string, limited to $min..$max,
+// or NULL if the value is missing or is not a whole number
+function get_int_arg($name, $min, $max = PHP_INT_MAX) {
+  if (!isset($_GET[$name]) || !is_string($_GET[$name]))
+    return NULL;
+  $value = filter_var(trim($_GET[$name]), FILTER_VALIDATE_INT);
+  if ($value === FALSE)
+    return NULL;
+  return max($min, min($max, $value));
+}
+
 function get_show_num() {
-  global $db, $num_stories;
-  $show = NULL;
-  if (isset($_GET['show']) && is_string($_GET['show'])) {
-    $show = $db->real_escape_string($_GET['show']);
-  }
-  if (is_numeric($show))
+  global $num_stories;
+  $show = get_int_arg('show', 1, MAX_SHOW);
+  if ($show !== NULL)
     return $show;
   else if ($num_stories)
-    return $num_stories;
+    return (int)$num_stories;
   else // provide fallback
     return 1;
 }
   
 function get_start_num() {
-  global $db;
-  $start = NULL;
-  if (isset($_GET['start']) && is_string($_GET['start'])) {
-    $start = $db->real_escape_string($_GET['start']);
-  }
-  if (!is_numeric($start))
-    $start = 0;
-  return $start;
+  $start = get_int_arg('start', 0);
+  return $start === NULL ? 0 : $start;
 } 
 
 /*