example: HTML escape WHOIS registrant data

This commit is contained in:
James 2023-03-14 13:38:00 +00:00
parent c0997b4f51
commit 253f052154

View file

@ -66,7 +66,7 @@ if (isSet($_GET['query']))
case 'object': case 'object':
if ($whois->Query['status'] < 0) if ($whois->Query['status'] < 0)
{ {
$winfo = implode($whois->Query['errstr'],"\n<br></br>"); $winfo = html_escape_and_implode($whois->Query['errstr'],"\n<br></br>");
} }
else else
{ {
@ -84,7 +84,7 @@ if (isSet($_GET['query']))
else else
{ {
if (isset($whois->Query['errstr'])) if (isset($whois->Query['errstr']))
$winfo = implode($whois->Query['errstr'],"\n<br></br>"); $winfo = html_escape_and_implode($whois->Query['errstr'],"\n<br></br>");
else else
$winfo = 'Unexpected error'; $winfo = 'Unexpected error';
} }
@ -97,11 +97,11 @@ if (isSet($_GET['query']))
default: default:
if(!empty($result['rawdata'])) if(!empty($result['rawdata']))
{ {
$winfo .= '<pre>'.implode($result['rawdata'],"\n").'</pre>'; $winfo .= '<pre>'.html_escape_and_implode($result['rawdata'], "\n").'</pre>';
} }
else else
{ {
$winfo = implode($whois->Query['errstr'],"\n<br></br>"); $winfo = html_escape_and_implode($whois->Query['errstr'],"\n<br></br>");
} }
} }
@ -118,6 +118,21 @@ exit(str_replace('{results}', $resout, $out));
//------------------------------------------------------------------------- //-------------------------------------------------------------------------
function html_escape_and_implode( $pieces, $glue )
{
$escaped_pieces = array();
if (is_string($pieces)) {
$pieces = array($pieces);
}
foreach ($pieces as $piece) {
array_push($escaped_pieces, htmlspecialchars($piece, ENT_QUOTES));
}
return implode( $glue, $escaped_pieces );
}
function extract_block (&$plantilla,$mark,$retmark='') function extract_block (&$plantilla,$mark,$retmark='')
{ {
$start = strpos($plantilla,'<!--'.$mark.'-->'); $start = strpos($plantilla,'<!--'.$mark.'-->');