On line 114:
<?php echo $recipients; ?>
The variable is not escaped, and is taken directly from $_POST. I think that in theory, someone making a POST request to this URL, containing some malicious HTML, could inject HTML inside the page.
Solution: escape all variables displayed in a HTML document.
Suggestion: use a templating engine like Smarty with auto-escaping enabled :)
On line 114:
The variable is not escaped, and is taken directly from
$_POST. I think that in theory, someone making a POST request to this URL, containing some malicious HTML, could inject HTML inside the page.Solution: escape all variables displayed in a HTML document.
Suggestion: use a templating engine like Smarty with auto-escaping enabled :)