[Noalyss-commit] [noalyss] 16/23: IText : protect against Quote and Double Quote

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 4ff9782a1f0c003d8cbc6461ec8a00bdcbfad1ef
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Sat Nov 14 19:40:03 2020 +0100

    IText : protect against Quote and Double Quote
---
 include/lib/itext.class.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/lib/itext.class.php b/include/lib/itext.class.php
index e74c238..fdbd114 100644
--- a/include/lib/itext.class.php
+++ b/include/lib/itext.class.php
@@ -48,7 +48,6 @@ class IText extends HtmlInput
 
         $t= 'title="'.$this->title.'" ';
         $autofocus=($this->autofocus)?" autofocus ":"";
-        $this->value=str_replace('"','',$this->value);
         $require=($this->require)?"required":"";
         if ( ! isset ($this->css_size))
         {
@@ -58,7 +57,7 @@ class IText extends HtmlInput
                     ',$this->style,
                     $this->id,
                     $this->name,
-                    htmlentities($this->value, ENT_COMPAT, "UTF-8"),
+                    htmlentities($this->value, ENT_COMPAT|ENT_QUOTES, "UTF-8"),
                     $this->placeholder,
                     $this->title,
                     $this->size,
@@ -73,7 +72,7 @@ class IText extends HtmlInput
                     ',$this->style,
                     $this->id,
                     $this->name,
-                    htmlentities($this->value, ENT_COMPAT, "UTF-8"),
+                     htmlentities($this->value, ENT_COMPAT|ENT_QUOTES, 
"UTF-8"),
                     $this->placeholder,
                     $this->title,
                     $this->css_size,
@@ -98,7 +97,7 @@ class IText extends HtmlInput
         $extra=(isset($this->extra))?$this->extra:"";
 
         $readonly=" readonly ";
-        $this->value=str_replace('"','',$this->value);
+        htmlentities($this->value, ENT_COMPAT|ENT_QUOTES, "UTF-8"),
                 $this->style=' class="input_text_ro" ';
          if ( ! isset ($this->css_size))
         {