攻撃の回避

broadcast/index.php

@@ -11,6 +11,7 @@ $page = (int) ($_GET['p'] ?? 1);
 $length = (int) ($_GET['max'] ?? 20);
 $asc = ($_GET['asc'] ?? 0) != 0;
 $keyword = trim ($_GET['q'] ?? '');
+$escaped = ($_GET['escaped'] ?? 0) != 0;
 
 $f = fopen (LOG_PATH, 'r');
 
@@ -22,9 +23,9 @@ if ($f !== false)
 
         $log_data[] = ['date_time'    => $dt[0],
                        'chat_icon'    => $chat_info -> author -> imageUrl,
-                       'chat_name'    => $chat_info -> author -> name,
-                       'chat_message' => $chat_info -> message,
-                       'answer'       => $dt[2]];
+                       'chat_name'    => $escaped ? htmlspecialchars ($chat_info -> author -> name) : $chat_info -> author -> name,
+                       'chat_message' => $escaped ? htmlspecialchars ($chat_info -> message) : $chat_info -> message,
+                       'answer'       => $escaped ? htmlspecialchars ($dt[2]) : $dt[2]];
       }
   }