Sanitize inputs to prevent XSS

opendcim · Sep 20, 2019 · c18696e · c18696e
1 parent 0bfe60b
commit c18696e
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/search.php b/search.php
@@ -7,6 +7,8 @@
 	$searchTerm=preg_replace("/[[:cntrl:]]/","",$_REQUEST['search']);
 	//Remove any extra quotes that could get passed in from some funky js or something
 	$searchTerm=str_replace(array("'",'"'),"",$searchTerm);
+	# prevent XSS script injection reported by mullaneywt
+	$searchKey=sanitize($searchKey);
 	# prevent script injection where we display the searchTerm in the title
 	# reported by Jacob Senn, Capital One
 	$searchTerm=sanitize($searchTerm);