Fix XSS on database comment, thanks to laurent gaffié.

2006-11-18 19:33:14 +00:00
parent b651ac38da
commit cceeae91e9
2 changed files with 4 additions and 2 deletions
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -180,11 +180,11 @@ function PMA_getHtmlSelectDb($selected = '')
        }
        foreach ($dbs as $db) {
            $return .= '<option value="' . $db['name'] . '"'
-                .' title="' . $db['comment'] . '"';
+                .' title="' . htmlspecialchars($db['comment']) . '"';
            if ($db['name'] == $selected) {
                $return .= ' selected="selected"';
            }
-            $return .= '>' . ($cut ? $db['disp_name_cut'] : $db['disp_name'])
+            $return .= '>' . htmlspecialchars($cut ? $db['disp_name_cut'] : $db['disp_name'])
                .' (' . $db['num_tables'] . ')</option>' . "\n";
        }
        if (count($dbs) > 1) {