[kp380lv]

Potential dangerous XSS hole in simpaty.php

Find this:

<form action=\"" . $_SERVER["PHP_SELF"] . "?action=add&amp;" . ($resp_type == 1?'good':'bad') . "&amp;type=$type&amp;targetid=$targetid\" method=\"post\">

And replace with this:

<form action=\"" . $_SERVER["PHP_SELF"] . "?action=add&amp;" . ($resp_type == 1?'good':'bad') . "&amp;type=".htmlspecialchars($type)."&amp;targetid=$targetid\" method=\"post\">

Then in simpaty.php find this:

$type = $_GET['type'

And replace with:

$type = htmlentities($_GET['type']);

index.php - (Blind SQL Injection in index.php)

Find this:

$choice = $_POST["choice"];

Replace with:

$choice = (int) $_POST["choice"];

This list still be updated!!!