fix(admin): escape stored player values in admin templates [#139] (#272)

2026-08-11 13:51:00 +00:00 · 2026-06-23 21:00:51 +02:00
parent 90c5cdd97c
commit c0bbf2bfbe
12 changed files with 19 additions and 19 deletions
@@ -48,7 +48,7 @@

    <thead>
        <tr>
-            <th colspan="2">Player <a href="admin.php?p=player&uid=<?php echo $user['id'];?>"><?php echo $user['username'];?></a></th>
+            <th colspan="2">Player <a href="admin.php?p=player&uid=<?php echo $user['id'];?>"><?php echo htmlspecialchars($user['username']);?></a></th>
        </tr>
        <tr>
            <td>Details</td>