HTML Tags gets executed on zebra log window

[09173732546]

Hi,

I tried to save this in the database, this gets executed on zebra log window

$message = "<script>alert('hello');</script>";

I used TRIM("' . $db->escape($message) . '") and is saved as <script>alert('hello');</script> and it gets executed as XSS after SELECT query.

I did not escape and is saved as <script>alert('hello');</script> and it gets executed as XSS after SELECT query.

if i will use htmlspecialchars the html will output normally, but still it gets executed as xss on the zebra log window.

i think i have no issues before, but when i downloaded the latest zebra_database and used php7.2 this thing happened.

[stefangabos]

I can't reproduce this using any of the methods below:

$message = "<script>alert('hello');</script>";

// everything ok
$db->insert('table', array(
    'column'   =>  $message,
));

// everything ok
$db->query('INSERT INTO table (column) VALUES (?)', array(message));

// everything ok
$db->query('INSERT INTO table (column) VALUES ("' . $db->escape($message) . '")');

[stefangabos]

oh, i see what you mean: the error is when SELECTing that inserted row. on it

[stefangabos]

should be fixed now. thanks a lot for reporting!