HTML escaping.

[squirrelmail.git] / src / vcard.php

diff --git a/src/vcard.php b/src/vcard.php
index cd104b9a6c98e87bd50997b15ffceba0ba08b30f..1fac0172c3c353303ffd81d0910213fd3fd0b8f3 100644 (file)
--- a/src/vcard.php
+++ b/src/vcard.php
@@ -3,15 +3,19 @@
 /**
  * vcard.php
  *
- * Copyright (c) 1999-2003 The SquirrelMail Project Team
+ * Copyright (c) 1999-2004 The SquirrelMail Project Team
  * Licensed under the GNU GPL. For full terms see the file COPYING.
  *
  * This file shows an attched vcard
  *
- * $Id$
+ * @version $Id$
+ * @package squirrelmail
  */
 
-/* Path for SquirrelMail required files. */
+/**
+ * Path for SquirrelMail required files.
+ * @ignore
+ */
 Define('SM_PATH','../');
 
 /* SquirrelMail required files. */
@@ -22,13 +26,14 @@ require_once(SM_PATH . 'functions/mime.php');
 require_once(SM_PATH . 'include/load_prefs.php');
 
 /* globals */
-$key  = $_COOKIE['key'];
-$username = $_SESSION['username'];
-$onetimepad = $_SESSION['onetimepad'];
-$mailbox = urldecode($_GET['mailbox']);
-$passed_id = (int) $_GET['passed_id'];
-$ent_id = $_GET['ent_id'];
-$startMessage = (int) $_GET['startMessage'];
+sqgetGlobalVar('username', $username, SQ_SESSION);
+sqgetGlobalVar('key', $key, SQ_COOKIE);
+sqgetGlobalVar('onetimepad', $onetimepad, SQ_SESSION);
+
+sqgetGlobalVar('passed_id', $passed_id, SQ_GET);
+sqgetGlobalVar('mailbox', $mailbox, SQ_GET);
+sqgetGlobalVar('ent_id', $ent_id, SQ_GET);
+sqgetGlobalVar('startMessage', $startMessage, SQ_GET);
 /* end globals */
 
 $imapConnection = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
@@ -43,8 +48,8 @@ echo '<br><table width="100%" border="0" cellspacing="0" cellpadding="2" ' .
         '<b><center>' .
         _("Viewing a Business Card") . " - ";
 $msg_url = 'read_body.php?mailbox='.urlencode($mailbox).
-    '&amp;startMessage='.$startMessage.
-    '&amp;passed_id='.$passed_id;
+    '&amp;startMessage='.urlencode($startMessage).
+    '&amp;passed_id='.urlencode($passed_id);
 
 $msg_url = set_url_var($msg_url, 'ent_id', 0);
 
@@ -114,10 +119,11 @@ $ShowValues = array(
 echo '<tr><td><br>' .
         '<TABLE border=0 cellpadding=2 cellspacing=0 align=center>' . "\n";
 
-if (isset($vcard_safe['email;internet'])) {     $vcard_safe['email;internet'] = '<A HREF="../src/compose.php?send_to=' .
-        $vcard_safe['email;internet'] . '">' . $vcard_safe['email;internet'] .
-        '</A>';
+if (isset($vcard_safe['email;internet'])) {
+    $vcard_safe['email;internet'] = makeComposeLink('src/compose.php?send_to='.urlencode($vcard_safe['email;internet']),
+        $vcard_safe['email;internet']);
 }
+
 if (isset($vcard_safe['url'])) {
     $vcard_safe['url'] = '<A HREF="' . $vcard_safe['url'] . '">' .
         $vcard_safe['url'] . '</A>';
@@ -141,74 +147,60 @@ echo '</table>' .
         _("Add to Addressbook") .
         '</td></tr>' .
         '<tr><td align=center>' .
-        '<FORM ACTION="../src/addressbook.php" METHOD="POST" NAME=f_add>' .
+       addForm('../src/addressbook.php', 'POST', 'f_add') .
         '<table border=0 cellpadding=2 cellspacing=0 align=center>' .
         '<tr><td align=right><b>Nickname:</b></td>' .
-        '<td><input type=text name="addaddr[nickname]" size=20 value="' .
-        $vcard_safe['firstname'] . '-' . $vcard_safe['lastname'] .
-        '"></td></tr>' .
-        '<tr><td align=right><b>Note Field Contains:</b></td><td>' .
-        '<select name="addaddr[label]">';
+        '<td>'.
+       addInput('addaddr[nickname]', $vcard_safe['firstname'] . '-' . $vcard_safe['lastname'], '20').
+        '</td></tr>' .
+        '<tr><td align=right><b>Note Field Contains:</b></td><td>' ;
 
+$opts = array();
 if (isset($vcard_nice['url'])) {
-    echo '<option value="' . htmlspecialchars($vcard_nice['url']) .
-        '">' . _("Web Page") . "</option>\n";
+    $opts[$vcard_nice['url']] = _("Web Page");
 }
 if (isset($vcard_nice['adr'])) {
-    echo '<option value="' . $vcard_nice['adr'] .
-        '">' . _("Address") . "</option>\n";
+    $opts[$vcard_nice['adr']] = _("Address");
 }
 if (isset($vcard_nice['title'])) {
-    echo '<option value="' . $vcard_nice['title'] .
-        '">' . _("Title") . "</option>\n";
+    $opts[$vcard_nice['title']] = _("Title");
 }
 if (isset($vcard_nice['org'])) {
-    echo '<option value="' . $vcard_nice['org'] .
-        '">' . _("Organization / Department") . "</option>\n";
+    $opts[$vcard_nice['org']] = _("Organization / Department");
 }
 if (isset($vcard_nice['title'])) {
-    echo '<option value="' . $vcard_nice['title'] .
-        '; ' . $vcard_nice['org'] .
-        '">' . _("Title & Org. / Dept.") . "</option>\n";
+    $opts[$vcard_nice['title'].'; '.$vcard_nice['org']] = _("Title & Org. / Dept.");
 }
 if (isset($vcard_nice['tel;work'])) {
-    echo '<option value="' . $vcard_nice['tel;work'] .
-        '">' . _("Work Phone") . "</option>\n";
+    $opts[$vcard_nice['tel;work']] = _("Work Phone");
 }
 if (isset($vcard_nice['tel;home'])) {
-    echo '<option value="' . $vcard_nice['tel;home'] .
-        '">' . _("Home Phone") . "</option>\n";
+    $opts[$vcard_nice['tel;home']] = _("Home Phone");
 }
 if (isset($vcard_nice['tel;cell'])) {
-    echo '<option value="' . $vcard_nice['tel;cell'] .
-        '">' . _("Cellular Phone") . "</option>\n";
+    $opts[$vcard_nice['tel;cell']] = _("Cellular Phone");
 }
 if (isset($vcard_nice['tel;fax'])) {
-    echo '<option value="' . $vcard_nice['tel;fax'] .
-        '">' . _("Fax") . "</option>\n";
+    $opts[$vcard_nice['tel;fax']] = _("Fax");
 }
 if (isset($vcard_nice['note'])) {
-    echo '<option value="' . $vcard_nice['note'] .
-        '">' . _("Note") . "</option>\n";
+    $opts[$vcard_nice['note']] = _("Note");
 }
-echo '</select>' .
-        '</td></tr>' .
+
+echo    addSelect('addaddr[label]', $opts, '', TRUE);
+echo    '</td></tr>' .
         '<tr><td colspan=2 align=center>' .
-        '<INPUT NAME="addaddr[email]" type=hidden value="' .
-        htmlspecialchars($vcard_nice['email;internet']) . '">' .
-        '<INPUT NAME="addaddr[firstname]" type=hidden value="' .
-        $vcard_safe['firstname'] . '">' .
-        '<INPUT NAME="addaddr[lastname]" type=hidden value="' .
-        $vcard_safe['lastname'] . '">' .
-        '<INPUT TYPE=submit NAME="addaddr[SUBMIT]" ' .
-        'VALUE="Add to Address Book">' .
+       addHidden('addaddr[email]', $vcard_nice['email;internet']).
+       addHidden('addaddr[firstname]', $vcard_safe['firstname']).
+       addHidden('addaddr[lastname]', $vcard_safe['lastname']).
+       addSubmit(_("Add to Address Book"), 'addaddr[SUBMIT]').
         '</td></tr>' .
         '</table>' .
-        '</FORM>' .
+        '</form>' .
         '</td></tr>' .
         '<tr><td align=center>' .
         '<a href="../src/download.php?absolute_dl=true&amp;passed_id=' .
-        $passed_id . '&amp;mailbox=' . urlencode($mailbox) .
+        urlencode($passed_id) . '&amp;mailbox=' . urlencode($mailbox) .
         '&amp;ent_id=' . urlencode($ent_id) . '">' .
         _("Download this as a file") . '</A>' .
         '</TD></TR></TABLE>' .