Skip to content

Commit 8597f25

Browse files
author
daintree
committed
fully qualify htmlspecialchars() function
git-svn-id: https://svn.code.sf.net/p/web-erp/code/trunk@4950 09516a42-71f9-43be-811f-9b821cf0d246
1 parent ea794d1 commit 8597f25

File tree

264 files changed

+645
-643
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

264 files changed

+645
-643
lines changed

‎AddCustomerTypeNotes.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@
147147
}
148148
if (isset($Id)) {
149149
echo '<div class="centre">
150-
<a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?DebtorType=' . $DebtorType . '">' . _('Review all notes for this Customer Type') .'</a>
150+
<a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?DebtorType=' . $DebtorType . '">' . _('Review all notes for this Customer Type') .'</a>
151151
</div>';
152152
}
153153

‎AuditTrail.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
// Get list of users
3535
$UserResult = DB_query("SELECT userid FROM www_users",$db);
3636

37-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
37+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">';
3838
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
3939
echo '<table class="selection">';
4040

‎BOMExtendedQty.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@
262262

263263
echo '<br />
264264
<br />
265-
<form action=' . htmlspecialchars($_SERVER['PHP_SELF']) . ' method="post">
265+
<form action=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . ' method="post">
266266
<table class="selection">
267267
<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />
268268
<tr>

‎BOMIndented.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@
247247

248248
echo '<br />
249249
<br />
250-
<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
250+
<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
251251
<table class="selection">';
252252
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
253253
echo '<tr>

‎BOMIndentedReverse.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@
235235
_('Search') . '" alt="" />' . ' ' . $title.'</p><br />';
236236
echo '<br />
237237
<br />
238-
<form action=' . htmlspecialchars($_SERVER['PHP_SELF']) . ' method="post">
238+
<form action=' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . ' method="post">
239239
<table class="selection">
240240
<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />
241241
<tr>

‎BOMInquiry.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
}
1414

1515
if (!isset($_POST['StockID'])) {
16-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">
16+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">
1717
<b>
1818
<br />
1919
</b>

‎BOMListing.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@
112112

113113
/*if $FromCriteria is not set then show a form to allow input */
114114

115-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="POST">
115+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="POST">
116116
<table class="selection">';
117117
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
118118

‎BOMs.php

+10-10
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
113113
$DrillID='';
114114
} else {
115115
$DrillText = '<a href="%s&Select=%s">' . _('Drill Down');
116-
$DrillLink = htmlspecialchars($_SERVER['PHP_SELF']) . '?';
116+
$DrillLink = htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?';
117117
$DrillID=$myrow['component'];
118118
}
119119
if ($ParentMBflag!='M' AND $ParentMBflag!='G'){
@@ -160,12 +160,12 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
160160
ConvertSQLDate($myrow['effectiveto']),
161161
$AutoIssue,
162162
$QuantityOnHand,
163-
htmlspecialchars($_SERVER['PHP_SELF']) . '?',
163+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
164164
$Parent,
165165
$myrow['component'],
166166
$DrillLink,
167167
$DrillID,
168-
htmlspecialchars($_SERVER['PHP_SELF']) . '?',
168+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
169169
$Parent,
170170
$myrow['component'],
171171
$UltimateParent);
@@ -418,7 +418,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
418418
break;
419419
}
420420

421-
echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Select a Different BOM') . '</a></div><br />';
421+
echo '<br /><div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Select a Different BOM') . '</a></div><br />';
422422
echo '<table class="selection">';
423423
// Display Manufatured Parent Items
424424
$sql = "SELECT bom.parent,
@@ -437,7 +437,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
437437
if( DB_num_rows($result) > 0 ) {
438438
echo '<tr><td><div class="centre">'._('Manufactured parent items').' : ';
439439
while ($myrow = DB_fetch_array($result)){
440-
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
440+
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
441441
$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
442442
$ix++;
443443
} //end while loop
@@ -460,7 +460,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
460460
echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Assembly parent items').' : ';
461461
$ix = 0;
462462
while ($myrow = DB_fetch_array($result)){
463-
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
463+
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
464464
$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
465465
$ix++;
466466
} //end while loop
@@ -482,7 +482,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
482482
echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Kit sets').' : ';
483483
$ix = 0;
484484
while ($myrow = DB_fetch_array($result)){
485-
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
485+
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
486486
$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
487487
$ix++;
488488
} //end while loop
@@ -504,7 +504,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
504504
echo (($reqnl)?'<br />':'').'<tr><td><div class="centre">'._('Phantom').' : ';
505505
$ix = 0;
506506
while ($myrow = DB_fetch_array($result)){
507-
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF']) . '?Select='.$myrow['parent'].'">'.
507+
echo (($ix)?', ':'').'<a href="'.htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select='.$myrow['parent'].'">'.
508508
$myrow['description'].'&nbsp;('.$myrow['parent'].')</a>';
509509
$ix++;
510510
} //end while loop
@@ -564,7 +564,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
564564

565565
if (! isset($_GET['delete'])) {
566566

567-
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?Select=' . $SelectedParent .'">';
567+
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?Select=' . $SelectedParent .'">';
568568
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
569569

570570
if (isset($_GET['SelectedComponent']) and $InputError !=1) {
@@ -830,7 +830,7 @@ function DisplayBOMItems($UltimateParent, $Parent, $Component,$Level, $db) {
830830
if (!isset($SelectedParent)) {
831831

832832
echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/magnifier.png" title="' . _('Search') . '" alt="" />' . ' ' . $title . '</p>';
833-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">' .
833+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '" method="post">' .
834834
'<div class="page_help_text">'. _('Select a manufactured part') . ' (' . _('or Assembly or Kit part') . ') ' . _('to maintain the bill of material for using the options below') . '<br /><font size="1">' . _('Parts must be defined in the stock item entry') . '/' . _('modification screen as manufactured') . ', ' . _('kits or assemblies to be available for construction of a bill of material') .'</div>'. '</font>
835835
<br />
836836
<table class="selection" cellpadding="3" colspan="4">

‎BackupDatabase.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
prnMsg(_('Once you have downloaded the database backup file to your local machine you should use the link below to delete it - backup files can consume a lot of space on your hosting account and will accumulate if not deleted - they also contain sensitive information which would otherwise be available for others to download!'),'info');
4545
echo '<br />
4646
<br />
47-
<a href="'. htmlspecialchars($_SERVER['PHP_SELF']) . '?BackupFile=' .$BackupFile .'">' . _('Delete the backup file off the server') . '</a>';
47+
<a href="'. htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?BackupFile=' .$BackupFile .'">' . _('Delete the backup file off the server') . '</a>';
4848
} else {
4949
prnMsg(_('There was some problem producing a backup using mysqldump. Normally this relates to a permissions issue - the web-server user must have permission to write to the companies directory'),'error');
5050
}

‎BankReconciliation.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
include('includes/header.inc');
1010

11-
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
11+
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
1212
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
1313
echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/money_add.png" title="' . _('Search') . '" alt="" />' . ' ' . $title.'</p><br />';
1414

‎COGSGLPostings.php

+6-6
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,9 @@
111111
$myrow['stkcat'],
112112
$myrow['salestype'],
113113
$myrow['accountname'],
114-
htmlspecialchars($_SERVER['PHP_SELF']) . '?',
114+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
115115
$myrow['id'],
116-
htmlspecialchars($_SERVER['PHP_SELF']). '?',
116+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8'). '?',
117117
$myrow['id']);
118118
}//end while
119119
echo '</table>';
@@ -210,9 +210,9 @@
210210
$myrow['stkcat'],
211211
$myrow['salestype'],
212212
$myrow['accountname'],
213-
htmlspecialchars($_SERVER['PHP_SELF']) . '?',
213+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
214214
$myrow['id'],
215-
htmlspecialchars($_SERVER['PHP_SELF']) . '?',
215+
htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?',
216216
$myrow['id']);
217217

218218
}//END WHILE LIST LOOP
@@ -222,12 +222,12 @@
222222
//end of ifs and buts!
223223

224224
if (isset($SelectedCOGSPostingID)) {
225-
echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) .'">' . _('Show all cost of sales posting records') . '</a></div>';
225+
echo '<div class="centre"><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') .'">' . _('Show all cost of sales posting records') . '</a></div>';
226226
}
227227

228228
echo '<br />';
229229

230-
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
230+
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
231231
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
232232

233233
if (isset($SelectedCOGSPostingID)) {

‎CompanyPreferences.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@
153153
echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/maintenance.png" title="' . _('Search') .
154154
'" alt="" />' . ' ' . $title.'</p><br />';
155155

156-
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '">';
156+
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">';
157157
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
158158
echo '<table class="selection">';
159159

‎ConfirmDispatch_Invoice.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,7 @@
266266
</table>
267267
<br />';
268268

269-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '" method="post">';
269+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '" method="post">';
270270
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
271271

272272
/***************************************************************

‎ContractBOM.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@
215215

216216
/* This is where the order as selected should be displayed reflecting any deletions or insertions*/
217217

218-
echo '<form name="ContractBOMForm" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '" method="post">';
218+
echo '<form name="ContractBOMForm" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '" method="post">';
219219
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
220220

221221
if (count($_SESSION['Contract'.$identifier]->ContractBOM)>0){
@@ -263,7 +263,7 @@
263263
<td>' . $ContractComponent->UOM . '</td>
264264
<td class="number">' . locale_number_format($ContractComponent->ItemCost,$_SESSION['CompanyRecord']['decimalplaces']) . '</td>
265265
<td class="number">' . $DisplayLineTotal . '</td>
266-
<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '&Delete=' . $ContractComponent->ComponentID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the contract BOM?') . '\');">' . _('Delete') . '</a></td></tr>';
266+
<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '&Delete=' . $ContractComponent->ComponentID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this item from the contract BOM?') . '\');">' . _('Delete') . '</a></td></tr>';
267267
$TotalCost += $LineTotal;
268268
}
269269

‎ContractCosting.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,7 @@
432432

433433
if ($_SESSION['Contract'.$identifier]->Status ==2){//the contract is an order being processed now
434434

435-
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?SelectedContract=' . $_SESSION['Contract'.$identifier]->ContractRef . '&identifier=' . $identifier . '">';
435+
echo '<form method="post" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?SelectedContract=' . $_SESSION['Contract'.$identifier]->ContractRef . '&identifier=' . $identifier . '">';
436436
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
437437
echo '<br />
438438
<div class="centre">

‎ContractOtherReqts.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@
7575

7676
/* This is where the other requirement as entered/modified should be displayed reflecting any deletions or insertions*/
7777

78-
echo '<form name="ContractReqtsForm" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '" method="post">';
78+
echo '<form name="ContractReqtsForm" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '" method="post">';
7979
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
8080
echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/contract.png" title="' . _('Contract Other Requirements') . '" alt="" /> ' . _('Contract Other Requirements') . ' - ' . $_SESSION['Contract'.$identifier]->CustomerName.'</p>';
8181

@@ -116,7 +116,7 @@
116116
<td><input type="text" class="number" name="Qty' . $ContractReqtID . '" size="11" value="' . locale_number_format($ContractComponent->Quantity,'Variable') . '" /></td>
117117
<td><input type="text" class="number" name="CostPerUnit' . $ContractReqtID . '" size="11" value="' . locale_number_format($ContractComponent->CostPerUnit,$_SESSION['CompanyRecord']['decimalplaces']) . '" /></td>
118118
<td class="number">' . $DisplayLineTotal . '</td>
119-
<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier. '&amp;Delete=' . $ContractReqtID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this contract requirement?') . '\');">' . _('Delete') . '</a></td>
119+
<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier. '&amp;Delete=' . $ContractReqtID . '" onclick="return confirm(\'' . _('Are you sure you wish to delete this contract requirement?') . '\');">' . _('Delete') . '</a></td>
120120
</tr>';
121121
$TotalCost += $LineTotal;
122122
}

‎Contracts.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -746,7 +746,7 @@
746746

747747
echo '<p class="page_title_text"><img src="'.$rootpath.'/css/'.$theme.'/images/contract.png" title="' .
748748
_('Contract') . '" alt="" />' . ' ' . _('Contract: Select Customer') . '</p>';
749-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier=' . $identifier .'" name="CustomerSelection" method="post">';
749+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier=' . $identifier .'" name="CustomerSelection" method="post">';
750750
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
751751

752752
echo '<table cellpadding="3" colspan="4" class="selection">
@@ -814,7 +814,7 @@
814814
//end if RequireCustomerSelection
815815
} else { /*A customer is already selected so get into the contract setup proper */
816816

817-
echo '<form name="ContractEntry" enctype="multipart/form-data" action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier=' . $identifier . '" method="post">';
817+
echo '<form name="ContractEntry" enctype="multipart/form-data" action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier=' . $identifier . '" method="post">';
818818
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
819819

820820
echo '<p class="page_title_text">

‎CounterSales.php

+5-5
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@
212212

213213
echo '<br /><br />';
214214
prnMsg(_('This sale has been cancelled as requested'),'success');
215-
echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Start a new Counter Sale') . '</a>';
215+
echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Start a new Counter Sale') . '</a>';
216216
include('includes/footer.inc');
217217
exit;
218218

@@ -361,7 +361,7 @@
361361

362362
/* Always do the stuff below */
363363

364-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '" name="SelectParts" method="post">';
364+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '" name="SelectParts" method="post">';
365365
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
366366

367367
//Get The exchange rate used for GPPercent calculations on adding or amending items
@@ -819,7 +819,7 @@
819819
$_SESSION['Items'.$identifier]->TaxGLCodes=$TaxGLCodes;
820820
echo '<td class="number">' . locale_number_format($TaxLineTotal ,$_SESSION['Items'.$identifier]->CurrDecimalPlaces) . '</td>';
821821
echo '<td class="number">' . locale_number_format($SubTotal + $TaxLineTotal ,$_SESSION['Items'.$identifier]->CurrDecimalPlaces) . '</td>';
822-
echo '<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?identifier='.$identifier . '&Delete=' . $OrderLine->LineNumber . '" onclick="return confirm(\'' . _('Are You Sure?') . '\');">' . _('Delete') . '</a></td></tr>';
822+
echo '<td><a href="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?identifier='.$identifier . '&Delete=' . $OrderLine->LineNumber . '" onclick="return confirm(\'' . _('Are You Sure?') . '\');">' . _('Delete') . '</a></td></tr>';
823823

824824
if ($_SESSION['AllowOrderLineItemNarrative'] == 1){
825825
echo $RowStarter;
@@ -1980,7 +1980,7 @@ functionalexrate,
19801980
} else {
19811981
echo '<img src="'.$rootpath.'/css/'.$theme.'/images/printer.png" title="' . _('Print') . '" alt="" />' . ' ' . '<a target="_blank" href="'.$rootpath.'/PrintCustTransPortrait.php?FromTransNo='.$InvoiceNo.'&InvOrCredit=Invoice&PrintPDF=True">'. _('Print this invoice'). ' (' . _('Portrait') . ')</a><br /><br />';
19821982
}
1983-
echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF']) . '">' . _('Start a new Counter Sale') . '</a></div>';
1983+
echo '<br /><br /><a href="' .htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '">' . _('Start a new Counter Sale') . '</a></div>';
19841984

19851985
}
19861986
// There were input errors so don't process nuffin
@@ -2197,7 +2197,7 @@ functionalexrate,
21972197

21982198
if (isset($SearchResult)) {
21992199
$j = 1;
2200-
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?' . SID .'identifier='.$identifier . '" method="post" name="orderform">';
2200+
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF'],ENT_QUOTES,'UTF-8') . '?' . SID .'identifier='.$identifier . '" method="post" name="orderform">';
22012201
echo '<input type="hidden" name="FormID" value="' . $_SESSION['FormID'] . '" />';
22022202
echo '<table class="table1">';
22032203
echo '<tr>

0 commit comments

Comments
 (0)