Menu ▾ ▴

#112 Category names are escaped instead of 'htmlspecialchar'ed

4.0.3
open
nobody
5
2004-08-30
2004-08-30
Pieter
No

When entering a category name containing quotes (in the
'Update Category" section), the quotes are escaped so
the backslash shows up in the category name in the
'Categories' section.

When entering HTML tags, they are not escaped (using
the php 'htmlspecialchars' function), so you can
actually enter html code in the category name to break
or 'enhance' the layout (probably including JavaScript
code ;-()

Discussion


Log in to post a comment.