SnowCode
/
threadr.lostcave.ddnss.de
forked from root/threadr.lostcave.ddnss.de
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

fixed html injection

master
BodgeMaster 2020-03-12 23:14:03 +01:00
parent 06d085859e
commit 4c6ede19a3
1 changed files with 21 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
threadr/board/board.php
View File

@ -5,20 +5,27 @@ $statement->execute(array("bid"=>$id));
foreach($statement->fetchAll() as $ROW) { foreach($statement->fetchAll() as $ROW) {
$statement = $pdo->prepare("SELECT * FROM users WHERE id=:uid"); $statement = $pdo->prepare("SELECT * FROM users WHERE id=:uid");
$statement->execute(array("uid"=>$ROW[user_id])); $statement->execute(array("uid"=>$ROW[user_id]));
$post_user = $statement->fetch();
echo "<section>"; $post_creator = $statement->fetch();
echo "<h1>$ROW[title]</h1>";
echo "<article>"; $post_title = htmlspecialchars($ROW['title']);
echo "<header>"; $post_creator_name = htmlspecialchars($post_creator['name']);
echo "<div>"; $post_time = htmlspecialchars($ROW['post_time']);
echo "<p class='beige'>$post_user[name] <time datetime='$ROW[post_time]'>$ROW[post_time]</time></p>"; $post_content = htmlspecialchars($ROW['content']);
echo "</div>";
echo "</header>"; echo "<section>
echo "<div class='postcontent'>"; <h1>$post_title</h1>
echo "<p>$ROW[content]</p>"; <article>
echo "</div>"; <header>
echo "</article>"; <div>
echo "</section>"; <p class='beige'> $post_creator_name <time datetime='$post_time'>$post_time</time></p>
</div>
</header>
<div class='postcontent'>
<p>$post_content</p>
</div>
</article>
</section>";
} }
?> ?>