htmlspecialchars

Author: simonLeary42

resources/lib/UnityHTTPD.php

@@ -37,6 +37,7 @@ public static function die(mixed $x = null, bool $show_user = false): never
     public static function redirect(?string $dest = null): never
     {
         $dest ??= pathJoin(CONFIG["site"]["prefix"], $_SERVER["REQUEST_URI"]);
+        $dest = htmlspecialchars($dest);
         header("Location: $dest");
         self::errorToUser("Redirect failed, click <a href='$dest'>here</a> to continue.", 302);
         self::die();

resources/templates/header.php

@@ -150,9 +150,9 @@
                 <button onclick=\"this.parentElement.style.display='none';\">×</button>
               </div>
             ",
-            $level->value,
-            strip_tags($title),
-            strip_tags($body)
+            htmlspecialchars($level->value),
+            htmlspecialchars($title),
+            htmlspecialchars($body)
         );
     }
     UnityHTTPD::clearMessages();