Preventively escape name

vrana · May 23, 2021 · ea1acfc · ea1acfc
1 parent 2dd65f0
commit ea1acfc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/adminer/include/editing.inc.php b/adminer/include/editing.inc.php
@@ -151,7 +151,7 @@ function set_adminer_settings($settings) {
 */
 function textarea($name, $value, $rows = 10, $cols = 80) {
  global $jush;
- echo "<textarea name='$name' rows='$rows' cols='$cols' class='sqlarea jush-$jush' spellcheck='false' wrap='off'>";
+ echo "<textarea name='" . h($name) . "' rows='$rows' cols='$cols' class='sqlarea jush-$jush' spellcheck='false' wrap='off'>";
  if (is_array($value)) {
  foreach ($value as $val) { // not implode() to save memory
  echo h($val[0]) . "\n\n\n"; // $val == array($query, $time, $elapsed)