From 038644b4a0abb74df9ebf23abbecbea8fdb540b7 Mon Sep 17 00:00:00 2001
From: Alberto Betella <albertobeta@users.noreply.github.com>
Date: Sun, 19 Sep 2021 08:10:14 -0400
Subject: [PATCH] Apply sanitization to user input

---
 PodcastGenerator/admin/pg_users.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/PodcastGenerator/admin/pg_users.php b/PodcastGenerator/admin/pg_users.php
index 13e3f637..6379221d 100644
--- a/PodcastGenerator/admin/pg_users.php
+++ b/PodcastGenerator/admin/pg_users.php
@@ -113,9 +113,9 @@
                         goto error;
                     }
                 ?>
-                <form action="pg_users.php?change=<?= $_GET['username'] ?>" method="POST">
+                <form action="pg_users.php?change=<?= strip_tags($_GET['username']) ?>" method="POST">
                     <?= _('Username') ?>:<br>
-                    <input type="text" name="username" value="<?= $_GET['username']; ?>" disabled> <small><?= _('You cannot edit usernames') ?></small><br>
+                    <input type="text" name="username" value="<?= strip_tags($_GET['username']); ?>" disabled> <small><?= _('You cannot edit usernames') ?></small><br>
                     <?= _('New Password') ?><br>
                     <input type="password" name="password"><br>
                     <?= _('Repeat new password') ?><br>
@@ -129,7 +129,7 @@
                 <?php if ($_GET['username'] == $_SESSION['username']) { /* Don't permit to delete the logged in user */ ?>
                     <p><?= _('You cannot delete yourself') ?></p>
                 <?php } else { ?>
-                    <form action="pg_users.php?delete=<?= $_GET['username'] ?>" method="POST">
+                    <form action="pg_users.php?delete=<?= strip_tags($_GET['username']) ?>" method="POST">
                         <input type="hidden" name="token" value="<?= $_SESSION['token' ] ?>">
                         <input class="btn btn-danger" type="submit" value="<?= _('Delete') ?>">
                     </form>