X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=plugins%2Fspamcop%2Fspamcop.php;h=2cf67cdee115d559df55d2cee119ed8054ca81aa;hp=5c97285dc238ff3e04af4b04630f3887cca6a958;hb=a9e1e670fab4399260e0790e018393c7dcefcecc;hpb=164584f0e97ba654bfe742bf6641dc53ae0f6827;ds=sidebyside

diff --git a/plugins/spamcop/spamcop.php b/plugins/spamcop/spamcop.php
index 5c97285d..2cf67cde 100644
--- a/plugins/spamcop/spamcop.php
+++ b/plugins/spamcop/spamcop.php
@@ -171,7 +171,7 @@ echo "</p>";
 ?>  <form method="post" action="<?PHP echo $form_action?>">
   <input type="hidden" name="mailbox" value="<?PHP echo htmlspecialchars($mailbox) ?>" />
   <input type="hidden" name="spamcop_is_composing" value="<?PHP echo htmlspecialchars($passed_id) ?>" />
-  <input type="hidden" name="send_to" value="<?PHP echo $report_email?>" />
+  <input type="hidden" name="send_to" value="<?PHP echo htmlspecialchars($report_email)?>" />
   <input type="hidden" name="subject" value="reply anyway" />
   <input type="hidden" name="identity" value="0" />
   <input type="hidden" name="session" value="<?PHP echo $session?>" />
@@ -198,7 +198,7 @@ echo "</p>";
    } ?>
   <input type="hidden" name="action" value="submit" />
   <input type="hidden" name="oldverbose" value="1" />
-  <input type="hidden" name="code" value="<?PHP echo $spamcop_id ?>" />
+  <input type="hidden" name="code" value="<?PHP echo htmlspecialchars($spamcop_id) ?>" />
   <input type="hidden" name="spam" value="<?PHP echo htmlspecialchars($spam_message); ?>" />
     <?php
 	echo '<input type="submit" name="x1" value="' . _("Send Spam Report") . "\" />\n";