[security] XSS and SQL injection

2009-10-12 21:47:40 +00:00
parent 14645a5035
commit 8ec5434999
5 changed files with 22 additions and 16 deletions
--- a/db_operations.php
+++ b/db_operations.php
@@ -627,7 +627,7 @@ if ($cfgRelation['pdfwork'] && $num_tables > 0) { ?>
        <?php
        while ($pages = @PMA_DBI_fetch_assoc($test_rs)) {
            echo '                <option value="' . $pages['page_nr'] . '">'
-                . $pages['page_nr'] . ': ' . $pages['page_descr'] . '</option>' . "\n";
+                . $pages['page_nr'] . ': ' . htmlspecialchars($pages['page_descr']) . '</option>' . "\n";
        } // end while
        PMA_DBI_free_result($test_rs);
        unset($test_rs);