Escape output on file upload messages

snyk123 · Aug 4, 2020 · db03bb6 · db03bb6
1 parent 79b5d81
commit db03bb6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/examples/send_file_upload.phps b/examples/send_file_upload.phps
@@ -48,7 +48,7 @@ if (array_key_exists('userfile', $_FILES)) {
         <input type="submit" value="Send File">
     </form>
 <?php } else {
-    echo $msg;
+    echo htmlspecialchars($msg);
 } ?>
 </body>
 </html>
diff --git a/examples/send_multiple_file_upload.phps b/examples/send_multiple_file_upload.phps
@@ -49,7 +49,7 @@ if (array_key_exists('userfile', $_FILES)) {
         <input type="submit" value="Send Files">
     </form>
 <?php } else {
-    echo $msg;
+    echo htmlspecialchars($msg);
 } ?>
 </body>
 </html>