Cross-site scripting (XSS) vulnerability in user.php

[m33x]

Hi there,

the user $_GET['user'] parameter is vulnerable to arbitrary Javascript code injection.

Please change

$user = $_GET['user'];

to

$user = htmlspecialchars($_GET['user'], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', true);

I haven't checked the rest of the application yet, but please consider this everywhere.

For Strings use:

$var_clean = htmlspecialchars($var, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', true);

For Integer use:

$var_clean = intval($var);

For Floats use:

$var_clean = floatval($var);

[ecleese]

Thank you for testing and offering a fix. I will make these changes in the next release.

[tripflex]

You could also use filter_input which should solve almost every case scenario:

http://php.net/manual/en/function.filter-input.php