global $color;
$td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
if (isset($values[$field])) {
- $td_str .= htmlspecialchars($values[$field]);
+ $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
}
$td_str .= '">' . $add . '';
return html_tag( 'tr' ,
/* Output form to add and modify address data */
function address_form($name, $submittext, $values = array()) {
global $color;
+
echo html_tag( 'table',
adressbook_inp_field(_("Nickname"), 'nickname', $name, 15, $values,
- '<SMALL>' . _("Must be unique") . '</SMALL>') .
+ ' <SMALL>' . _("Must be unique") . '</SMALL>') .
adressbook_inp_field(_("E-mail address"), 'email', $name, 45, $values, '') .
adressbook_inp_field(_("First name"), 'firstname', $name, 45, $values, '') .
adressbook_inp_field(_("Last name"), 'lastname', $name, 45, $values, '') .
, 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
}
-
/* Open addressbook, with error messages on but without LDAP (the *
* second "true"). Don't need LDAP here anyway */
$abook = addressbook_init(true, true);
displayPageHeader($color, 'None');
-
$defdata = array();
$formerror = '';
$abortform = false;
$showaddrlist = true;
$defselected = array();
+$form_url = 'addressbook.php';
/* Handle user's actions */
* Add new address *
**************************************************/
if (!empty($addaddr['nickname'])) {
-
+ foreach( $addaddr as $k => $adr ) {
+ $addaddr[$k] = strip_tags( $adr );
+ }
$r = $abook->add($addaddr, $abook->localbackend);
/* Handle error messages */
$showaddrlist = false;
$defdata = $addaddr;
}
-
} else {
/************************************************
$olddata = $abook->lookup($enick, $ebackend);
/* Display the "new address" form */
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' .
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' .
"\n" .
html_tag( 'table',
html_tag( 'tr',
"\n". '<strong>' . _("Update address") . '</strong>' ."\n",
'center', $color[0] )
),
- 'center', '', 'width="100%" ' ) .
+ 'center', '', 'width="100%" ' );
address_form("editaddr", _("Update address"), $olddata);
echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
htmlspecialchars($olddata["nickname"]) . "\">\n" .
'center', '', 'width="100%"' );
/* Display the "new address" form again */
- echo '<FORM ACTION="' . $PHP_SELF .
+ echo '<FORM ACTION="' . $form_url .
'" METHOD="POST">' . "\n" .
html_tag( 'table',
html_tag( 'tr',
/* List addresses */
if (count($alist) > 0) {
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' . "\n";
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' . "\n";
while(list($undef,$row) = each($alist)) {
/* New table header for each backend */
/* Display the "new address" form */
echo '<a name="AddAddress"></a>' . "\n" .
- '<FORM ACTION="' . $PHP_SELF . '" NAME=f_add METHOD="POST">' . "\n" .
- html_tag( 'table',
+ '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
+ html_tag( 'table',
html_tag( 'tr',
html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
'center', $color[0]
do_hook('addressbook_bottom');
?>
-</BODY></HTML>
+</BODY></HTML>
\ No newline at end of file