Prevent XSS attacks introduced by 213a24a

Thanks to @tomvangoethem for the report!
mathiasbynens · Oct 1, 2013 · b4d5538 · b4d5538
1 parent 257ce97
commit b4d5538
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -1,5 +1,7 @@
 # Simple PHP URL shortener
 
+Requires PHP ≥ 5.4.0 or higher.
+
 ## Installation
 
 1. Download the source code as located within this repository, and upload it to your web server.

diff --git a/index.php b/index.php
@@ -41,5 +41,6 @@
 
 header('Location: ' . $url, null, 301);
 
+$attributeValue = htmlspecialchars($url);
 ?>
-<meta http-equiv=refresh content="0;URL=<?php echo $url; ?>"><a href="<?php echo $url; ?>">Continue</a><script>location.href='<?php echo $url; ?>'</script>
+<meta http-equiv=refresh content="0;URL=<?php echo $attributeValue; ?>"><a href="<?php echo $attributeValue; ?>">Continue</a><script>location.href=<?php echo json_encode($url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES); ?></script>