Create PHP product and recipe management system - #1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <script> | ||
| function addIngredientRow() { | ||
| const tableBody = document.querySelector('#ingredients-table tbody'); | ||
| const template = document.createElement('tr'); | ||
| template.innerHTML = ` | ||
| <td> | ||
| <select name="ingredient_product_id[]" required> | ||
| <option value="">Selecione</option> | ||
| <?php foreach ($products as $product): ?> | ||
| <option value="<?php echo $product['id']; ?>"><?php echo htmlspecialchars($product['name']); ?></option> | ||
| <?php endforeach; ?> |
There was a problem hiding this comment.
The dynamic ingredient row template injects raw product names into a JavaScript template literal using only htmlspecialchars, which does not escape backticks or ${…}. A product name such as ${alert(1)} or one containing a backtick will terminate the literal or interpolate an expression, executing arbitrary JavaScript when the page loads and breaking the add‑ingredient feature. These values should be encoded for JavaScript context (e.g. via json_encode or manual escaping) before embedding in the template string.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
https://chatgpt.com/codex/tasks/task_e_69040190879083228d86ff6f16722254