I think htmlspecialchars should be used here

2011-06-21 12:08:48 +02:00
parent cb043f4365
commit dc6c1e8b5c
1 changed files with 1 additions and 1 deletions
--- a/import.php
+++ b/import.php
@@ -108,7 +108,7 @@ if ($import_type == 'table') {
    }
    $err_url  = $goto
              . '?' . $common
-              . (preg_match('@^tbl_[a-z]*\.php$@', $goto) ? '&amp;table=' . urlencode($table) : '');
+              . (preg_match('@^tbl_[a-z]*\.php$@', $goto) ? '&amp;table=' . htmlspecialchars($table) : '');
    $_SESSION['Import_message']['go_back_url'] = $err_url;
 }