From: Alex Dehnert <adehnert@mit.edu>
Date: Sat, 19 Mar 2011 07:29:57 +0000 (+0000)
Subject: Fix failure to escape HTML on login page
X-Git-Url: http://andersk.mit.edu/gitweb/sql-web.git/commitdiff_plain/4d35700712d07cd1caa6e47b1e03d26079f6f7ae

Fix failure to escape HTML on login page

git-svn-id: svn://sql.mit.edu/sql@189 a142d4bd-2cfb-0310-9673-cb33a7e74f58
---

diff --git a/tpl/login.php b/tpl/login.php
index a9ce2b5..17eabb4 100644
--- a/tpl/login.php
+++ b/tpl/login.php
@@ -12,15 +12,15 @@ $thisTxt = isSSL()?' using this Certificate':' using your MySQL Password';
 
 <form method=post action="<?=$URI?>">
 <p>Please enter your MySQL login information:</p>
-<p>username: <input type="text" name="u" value="<?=isset($i_u)?$i_u:''?>"></p>
+<p>username: <input type="text" name="u" value="<?=isset($i_u)?htmlentities($i_u):''?>"></p>
 <p>password: <input type="password" name="p"></p>
 
 <?php elseif (isSSL() && !empty($SSLCred)): ?>
 
 <form method=post action="<?=$URI?>">
-<p>You are identified as: <?=$SSLUsername?></p>
-<p><?=$SSLName?></p>
-<p><?=$SSLEmail?></p>
+<p>You are identified as: <?=htmlentities($SSLUsername)?></p>
+<p><?=htmlentities($SSLName)?></p>
+<p><?=htmlentities($SSLEmail)?></p>
 
 <?php endif; ?>