<scratchsig><script>location='https://www.youtube.com/watch?v=dQw4w9W…

…gXcQ';</script></scratchsig>
InternationalScratchWiki · Sep 15, 2020 · 4160a39 · 4160a39
1 parent 3f1af08
commit 4160a39
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/ScratchSig2.php b/ScratchSig2.php
@@ -67,7 +67,7 @@ function sigGetAvatarUrl ($username) {
 // Called to output HTML for <scratchsig> tag
 
 function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {
-    $username = $input;
+    $username = htmlspecialchars($input);
 
     $img_url = sigGetAvatarUrl($username);