force strip_tags() on all user input unless explicitly allowed

1 files changed, 11 insertions, 0 deletions

diff --git a/include/functions.php b/include/functions.php
index 417abfbb8..0fd8ef61a 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -725,6 +725,17 @@
 		}
 	}
 
+	// this is used for user http parameters unless HTML code is actually needed
+	function clean($param) {
+		if (is_array($param)) {
+			return array_map(strip_tags, $param);
+		} else if (is_string($param)) {
+			return strip_tags($param);
+		} else {
+			return $param;
+		}
+	}
+
 	function make_password($length = 8) {
 
 		$password = "";