Accept only whole numbers for start and show, and cap show at 50.

get_data.lib.php

@@ -292,29 +292,34 @@ function get_sort_arg() {
   return $sort;
 }
   
-function get_show_num() {
-  global $db, $num_stories;
-  $show = NULL;
-  if (isset($_GET['show']) && is_string($_GET['show'])) {
-    $show = $db->real_escape_string($_GET['show']);
+// The most stories that one page can show
+define('MAX_SHOW', 50);
+
+// Return a whole number from the query string, limited to $min..$max,
+// or NULL if the value is missing or is not a whole number
+function get_int_arg($name, $min, $max = PHP_INT_MAX) {
+  if (!isset($_GET[$name]) || !is_string($_GET[$name]))
+    return NULL;
+  $value = filter_var(trim($_GET[$name]), FILTER_VALIDATE_INT);
+  if ($value === FALSE)
+    return NULL;
+  return max($min, min($max, $value));
 }
-  if (is_numeric($show))
+
+function get_show_num() {
+  global $num_stories;
+  $show = get_int_arg('show', 1, MAX_SHOW);
+  if ($show !== NULL)
     return $show;
   else if ($num_stories)
-    return $num_stories;
+    return (int)$num_stories;
   else // provide fallback
     return 1;
 }
   
 function get_start_num() {
-  global $db;
-  $start = NULL;
-  if (isset($_GET['start']) && is_string($_GET['start'])) {
-    $start = $db->real_escape_string($_GET['start']);
-  }
-  if (!is_numeric($start))
-    $start = 0;
-  return $start;
+  $start = get_int_arg('start', 0);
+  return $start === NULL ? 0 : $start;
 } 
 
 /*