Improved listform class.

Author: tbrehm

interface/lib/classes/listform.inc.php

@@ -166,7 +166,7 @@ public function getSearchSQL($sql_where = '')
                     $this->searchValues[$search_prefix.$field] = $out;
             } else {
                 if(isset($_SESSION['search'][$list_name][$search_prefix.$field])){
-                    $this->searchValues[$search_prefix.$field] = $_SESSION['search'][$list_name][$search_prefix.$field];
+                    $this->searchValues[$search_prefix.$field] = htmlspecialchars($_SESSION['search'][$list_name][$search_prefix.$field]);
                 }
             }
         }
@@ -283,7 +283,7 @@ public function decode($record)
                 	switch ($field['datatype']){
                     case 'VARCHAR':
                     case 'TEXT':
-                        $record[$key] = stripslashes($record[$key]);
+                        $record[$key] = htmlentities(stripslashes($record[$key]));
                          break;
 
                     case 'DATE':
@@ -295,15 +295,15 @@ public function decode($record)
                         break;
 
                     case 'DOUBLE':
-                        $record[$key] = $record[$key];
+                        $record[$key] = htmlentities($record[$key]);
                         break;
 
                     case 'CURRENCY':
                         $record[$key] = number_format($record[$key], 2, ',', '');
                         break;
 
                     default:
-                        $record[$key] = stripslashes($record[$key]);
+                        $record[$key] = htmlentities(stripslashes($record[$key]));
                 	}
 				}
             }
@@ -360,6 +360,19 @@ function lng($msg) {
 			return $app->lng($msg);
 		}	
 	}
+	
+	function escapeArrayValues($search_values) {
+		
+		$out = array();
+		if(is_array($search_values)) {
+			foreach($search_values as $key => $val) {
+				$out[$key] = htmlentities($val,ENT_QUOTES);
+			}
+		}
+		
+		return $out;
+		
+	}
 
 }