Browse files

Prevent XSS attacks introduced by 213a24a

Thanks to @tomvangoethem for the report!
  • Loading branch information...
1 parent 257ce97 commit b4d553857fce607ffc0f283333878be551ce4667 @mathiasbynens committed Oct 1, 2013
Showing with 4 additions and 1 deletion.
  1. +2 −0 README.md
  2. +2 −1 index.php
View
2 README.md
@@ -1,5 +1,7 @@
# Simple PHP URL shortener
+Requires PHP ≥ 5.4.0 or higher.
+
## Installation
1. Download the source code as located within this repository, and upload it to your web server.
View
3 index.php
@@ -41,5 +41,6 @@
header('Location: ' . $url, null, 301);
+$attributeValue = htmlspecialchars($url);
?>
-<meta http-equiv=refresh content="0;URL=<?php echo $url; ?>"><a href="<?php echo $url; ?>">Continue</a><script>location.href='<?php echo $url; ?>'</script>
+<meta http-equiv=refresh content="0;URL=<?php echo $attributeValue; ?>"><a href="<?php echo $attributeValue; ?>">Continue</a><script>location.href=<?php echo json_encode($url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES); ?></script>

0 comments on commit b4d5538

Please sign in to comment.