From 7bc47a58fe5836070f226801eaea2be790f2b5de Mon Sep 17 00:00:00 2001 From: johnnyq Date: Tue, 14 Jul 2026 17:10:45 -0400 Subject: [PATCH] Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout --- admin/ai_model.php | 8 +- admin/ai_provider.php | 6 +- admin/api_keys.php | 12 +- admin/app_log.php | 24 +- admin/audit_log.php | 36 +-- admin/category.php | 18 +- admin/contract_template.php | 34 +-- admin/custom_link.php | 8 +- admin/document_template.php | 14 +- admin/document_template_details.php | 8 +- admin/identity_provider.php | 4 +- admin/includes/side_nav.php | 6 +- admin/mail_queue.php | 24 +- admin/modals/ai/ai_model_add.php | 2 +- admin/modals/ai/ai_model_edit.php | 8 +- admin/modals/ai/ai_provider_edit.php | 6 +- admin/modals/api/api_key_add.php | 2 +- admin/modals/category/category_add.php | 4 +- admin/modals/category/category_edit.php | 8 +- .../contract_template_edit.php | 12 +- .../custom_field/custom_field_create.php | 4 +- admin/modals/custom_link/custom_link_edit.php | 6 +- .../document_template_edit.php | 6 +- .../mail_queue/mail_queue_message_view.php | 16 +- .../payment_method/payment_method_edit.php | 4 +- .../payment_provider/payment_provider_add.php | 6 +- .../payment_provider_edit.php | 12 +- .../project_template_edit.php | 4 +- .../project_template_ticket_template_add.php | 2 +- admin/modals/role/role_add.php | 4 +- admin/modals/role/role_edit.php | 10 +- .../software_template_add.php | 2 +- .../software_template_edit.php | 14 +- admin/modals/tag/tag_edit.php | 6 +- admin/modals/tax/tax_edit.php | 2 +- .../ticket_status/ticket_status_edit.php | 4 +- .../ticket_template/ticket_template_add.php | 2 +- .../ticket_template_task_edit.php | 4 +- admin/modals/user/user_add.php | 4 +- admin/modals/user/user_archive.php | 10 +- admin/modals/user/user_edit.php | 14 +- admin/modals/user/user_restore.php | 8 +- admin/modules.php | 6 +- admin/payment_method.php | 6 +- admin/payment_provider.php | 10 +- admin/post/saved_payment_method.php | 6 +- admin/project_template.php | 8 +- admin/project_template_details.php | 18 +- admin/roles.php | 10 +- admin/saved_payment_method.php | 14 +- admin/settings_company.php | 28 +-- admin/settings_custom_fields.php | 10 +- admin/settings_default.php | 20 +- admin/settings_invoice.php | 8 +- admin/settings_localization.php | 4 +- admin/settings_mail.php | 46 ++-- admin/settings_module.php | 2 +- admin/settings_project.php | 2 +- admin/settings_quote.php | 6 +- admin/settings_security.php | 6 +- admin/settings_ticket.php | 4 +- admin/software_template.php | 14 +- admin/tag.php | 8 +- admin/tax.php | 2 +- admin/ticket_status.php | 6 +- admin/ticket_template.php | 10 +- admin/ticket_template_details.php | 14 +- admin/users.php | 22 +- agent/accounts.php | 8 +- agent/ajax.php | 8 +- agent/asset_details.php | 184 +++++++------- agent/assets.php | 68 +++--- agent/calendar.php | 20 +- agent/certificates.php | 20 +- agent/client_autopay.php | 12 +- agent/client_overview.php | 108 ++++----- agent/clients.php | 70 +++--- agent/contact_details.php | 192 +++++++-------- agent/contacts.php | 50 ++-- agent/credentials.php | 54 ++--- agent/dashboard.php | 32 +-- agent/document_details.php | 40 +-- agent/domains.php | 24 +- agent/expenses.php | 34 +-- agent/files.php | 42 ++-- agent/global_search.php | 138 +++++------ agent/includes/client_side_nav.php | 2 +- agent/includes/inc_all_client.php | 58 ++--- agent/includes/side_nav.php | 8 +- agent/invoice.php | 96 ++++---- agent/invoices.php | 38 +-- agent/locations.php | 46 ++-- agent/modals/account/account_edit.php | 4 +- agent/modals/asset/asset_add.php | 18 +- agent/modals/asset/asset_bulk_add_ticket.php | 6 +- .../asset/asset_bulk_assign_contact.php | 2 +- .../asset/asset_bulk_assign_location.php | 2 +- agent/modals/asset/asset_bulk_assign_tags.php | 2 +- agent/modals/asset/asset_bulk_edit_status.php | 2 +- .../asset/asset_bulk_transfer_client.php | 2 +- agent/modals/asset/asset_copy.php | 58 ++--- agent/modals/asset/asset_details.php | 178 +++++++------- agent/modals/asset/asset_documents.php | 2 +- agent/modals/asset/asset_edit.php | 76 +++--- agent/modals/asset/asset_interface_add.php | 10 +- .../asset_interface_bulk_edit_network.php | 4 +- .../asset/asset_interface_bulk_edit_type.php | 2 +- agent/modals/asset/asset_interface_edit.php | 28 +-- .../asset/asset_interface_multiple_add.php | 6 +- agent/modals/asset/asset_link_credential.php | 4 +- agent/modals/asset/asset_link_document.php | 4 +- agent/modals/asset/asset_link_file.php | 6 +- agent/modals/asset/asset_link_service.php | 4 +- agent/modals/asset/asset_link_software.php | 4 +- agent/modals/calendar/calendar_edit.php | 4 +- agent/modals/calendar/calendar_event_add.php | 8 +- agent/modals/calendar/calendar_event_edit.php | 24 +- agent/modals/certificate/certificate_add.php | 4 +- agent/modals/certificate/certificate_edit.php | 26 +- agent/modals/client/client_add.php | 4 +- .../modals/client/client_bulk_add_ticket.php | 6 +- .../modals/client/client_bulk_assign_tags.php | 2 +- .../client/client_bulk_edit_referral.php | 2 +- agent/modals/client/client_bulk_email.php | 18 +- agent/modals/client/client_credit_add.php | 2 +- agent/modals/client/client_edit.php | 22 +- agent/modals/contact/contact_add.php | 6 +- .../contact/contact_bulk_assign_location.php | 2 +- .../contact/contact_bulk_assign_tags.php | 2 +- agent/modals/contact/contact_bulk_email.php | 18 +- agent/modals/contact/contact_details.php | 152 ++++++------ agent/modals/contact/contact_edit.php | 36 +-- agent/modals/contact/contact_link_asset.php | 4 +- .../contact/contact_link_credential.php | 4 +- .../modals/contact/contact_link_document.php | 4 +- agent/modals/contact/contact_link_file.php | 6 +- agent/modals/contact/contact_link_service.php | 4 +- .../modals/contact/contact_link_software.php | 4 +- agent/modals/contact/contact_note_add.php | 4 +- agent/modals/credential/credential_add.php | 10 +- .../credential_bulk_assign_tags.php | 2 +- agent/modals/credential/credential_edit.php | 28 +-- agent/modals/credential/credential_view.php | 18 +- .../document/document_add_file_relation.php | 4 +- .../document/document_add_from_template.php | 4 +- agent/modals/document/document_bulk_move.php | 2 +- agent/modals/document/document_edit.php | 6 +- .../document/document_edit_visibility.php | 2 +- agent/modals/document/document_link_asset.php | 4 +- .../modals/document/document_link_contact.php | 4 +- agent/modals/document/document_link_file.php | 6 +- .../document/document_link_software.php | 4 +- agent/modals/document/document_move.php | 6 +- agent/modals/document/document_rename.php | 2 +- .../modals/document/document_version_view.php | 2 +- agent/modals/document/document_view.php | 2 +- agent/modals/domain/domain_add.php | 10 +- agent/modals/domain/domain_edit.php | 30 +-- agent/modals/expense/expense_add.php | 8 +- .../expense/expense_bulk_edit_account.php | 2 +- .../expense/expense_bulk_edit_category.php | 2 +- .../expense/expense_bulk_edit_client.php | 2 +- agent/modals/expense/expense_copy.php | 20 +- agent/modals/expense/expense_edit.php | 26 +- agent/modals/expense/expense_export.php | 6 +- agent/modals/expense/expense_refund.php | 12 +- agent/modals/file/file_bulk_move.php | 2 +- agent/modals/file/file_link_asset.php | 4 +- agent/modals/file/file_move.php | 8 +- agent/modals/file/file_rename.php | 6 +- agent/modals/folder/folder_add.php | 2 +- agent/modals/folder/folder_rename.php | 2 +- agent/modals/invoice/invoice_add.php | 4 +- agent/modals/invoice/invoice_add_ticket.php | 6 +- .../invoice/invoice_bulk_edit_category.php | 2 +- agent/modals/invoice/invoice_copy.php | 4 +- agent/modals/invoice/invoice_edit.php | 14 +- agent/modals/invoice/invoice_item_edit.php | 8 +- .../modals/invoice/invoice_recurring_add.php | 2 +- agent/modals/location/location_add.php | 6 +- .../location/location_bulk_assign_tags.php | 2 +- agent/modals/location/location_edit.php | 38 +-- agent/modals/network/network_add.php | 4 +- agent/modals/network/network_edit.php | 18 +- agent/modals/payment/invoice_apply_credit.php | 2 +- agent/modals/payment/payment_add.php | 16 +- agent/modals/payment/payment_bulk_add.php | 12 +- agent/modals/payment/payment_edit.php | 10 +- .../payment/payment_saved_method_add.php | 4 +- agent/modals/product/product_add.php | 6 +- .../product/product_bulk_edit_category.php | 2 +- agent/modals/product/product_edit.php | 16 +- agent/modals/product/product_stock_add.php | 4 +- agent/modals/project/project_add.php | 6 +- agent/modals/project/project_edit.php | 20 +- .../project/project_link_closed_ticket.php | 2 +- agent/modals/project/project_link_ticket.php | 8 +- agent/modals/quote/quote_add.php | 4 +- agent/modals/quote/quote_copy.php | 6 +- agent/modals/quote/quote_edit.php | 14 +- agent/modals/quote/quote_item_edit.php | 8 +- agent/modals/quote/quote_to_invoice.php | 2 +- agent/modals/rack/rack_add.php | 4 +- agent/modals/rack/rack_device_add.php | 4 +- agent/modals/rack/rack_edit.php | 24 +- .../recurring_expense_add.php | 8 +- .../recurring_expense_edit.php | 24 +- .../recurring_invoice_add.php | 4 +- .../recurring_invoice_edit.php | 12 +- .../recurring_invoice_item_edit.php | 8 +- .../recurring_ticket/recurring_ticket_add.php | 26 +- .../recurring_ticket_bulk_agent_edit.php | 2 +- .../recurring_ticket_bulk_category_edit.php | 2 +- .../recurring_ticket_edit.php | 26 +- agent/modals/revenue/revenue_add.php | 8 +- agent/modals/revenue/revenue_edit.php | 22 +- agent/modals/service/service_add.php | 18 +- agent/modals/service/service_details.php | 42 ++-- agent/modals/service/service_edit.php | 32 +-- agent/modals/share_modal.php | 4 +- agent/modals/software/software_add.php | 18 +- .../software/software_add_from_template.php | 4 +- agent/modals/software/software_edit.php | 40 +-- agent/modals/ticket/ticket_add.php | 32 +-- agent/modals/ticket/ticket_add_v2.php | 12 +- agent/modals/ticket/ticket_add_watcher.php | 4 +- agent/modals/ticket/ticket_assign.php | 8 +- agent/modals/ticket/ticket_billable.php | 2 +- .../modals/ticket/ticket_bulk_add_project.php | 4 +- agent/modals/ticket/ticket_bulk_assign.php | 2 +- .../ticket/ticket_bulk_edit_category.php | 2 +- agent/modals/ticket/ticket_bulk_merge.php | 8 +- agent/modals/ticket/ticket_bulk_reply.php | 2 +- agent/modals/ticket/ticket_change_client.php | 4 +- agent/modals/ticket/ticket_contact.php | 8 +- agent/modals/ticket/ticket_edit.php | 38 +-- agent/modals/ticket/ticket_edit_asset.php | 12 +- agent/modals/ticket/ticket_edit_project.php | 6 +- agent/modals/ticket/ticket_edit_schedule.php | 6 +- agent/modals/ticket/ticket_invoice_add.php | 48 ++-- agent/modals/ticket/ticket_merge.php | 12 +- agent/modals/ticket/ticket_priority.php | 6 +- agent/modals/ticket/ticket_quote_add.php | 26 +- agent/modals/ticket/ticket_reply_edit.php | 4 +- agent/modals/ticket/ticket_reply_redact.php | 2 +- .../ticket/ticket_task_approver_add.php | 2 +- agent/modals/ticket/ticket_task_edit.php | 14 +- agent/modals/transfer/transfer_add.php | 12 +- agent/modals/transfer/transfer_edit.php | 18 +- agent/modals/trip/trip_add.php | 14 +- agent/modals/trip/trip_copy.php | 28 +-- agent/modals/trip/trip_edit.php | 28 +-- agent/networks.php | 26 +- agent/notifications.php | 16 +- agent/payments.php | 36 +-- agent/post/client.php | 228 +++++++++--------- agent/post/invoice.php | 116 ++++----- agent/post/quote.php | 68 +++--- agent/post/task.php | 6 +- agent/post/ticket.php | 4 +- agent/products.php | 22 +- agent/project_details.php | 54 ++--- agent/projects.php | 28 +-- agent/quote.php | 90 +++---- agent/quotes.php | 28 +-- agent/racks.php | 30 +-- agent/recurring_expenses.php | 30 +-- agent/recurring_invoice.php | 84 +++---- agent/recurring_invoices.php | 30 +-- agent/recurring_tickets.php | 20 +- agent/reports/budget.php | 2 +- agent/reports/client_ticket_time_detail.php | 20 +- agent/reports/clients_with_balance.php | 2 +- agent/reports/credential_rotation.php | 8 +- agent/reports/expense_summary.php | 2 +- agent/reports/includes/reports_side_nav.php | 4 +- agent/reports/income_by_client.php | 2 +- agent/reports/income_summary.php | 2 +- agent/reports/profit_loss.php | 4 +- agent/reports/recurring_by_client.php | 2 +- agent/reports/tax_summary.php | 4 +- agent/reports/ticket_by_client.php | 8 +- agent/reports/tickets_unbilled.php | 2 +- agent/reports/time_by_tech.php | 4 +- agent/revenues.php | 24 +- agent/services.php | 24 +- agent/software.php | 24 +- agent/ticket.php | 174 ++++++------- agent/ticket_kanban.php | 4 +- agent/ticket_list.php | 34 +-- agent/tickets.php | 20 +- agent/transfers.php | 28 +-- agent/trips.php | 26 +- agent/user/includes/user_side_nav.php | 2 +- agent/user/mfa_enforcement.php | 4 +- agent/user/user_activity.php | 16 +- agent/user/user_details.php | 8 +- agent/user/user_security.php | 2 +- client/assets.php | 20 +- client/certificates.php | 8 +- client/contact_edit.php | 10 +- client/contacts.php | 4 +- client/document.php | 10 +- client/documents.php | 6 +- client/domains.php | 4 +- client/includes/footer.php | 2 +- client/includes/header.php | 14 +- client/index.php | 8 +- client/invoices.php | 12 +- client/login_reset.php | 6 +- client/post.php | 16 +- client/profile.php | 2 +- client/quotes.php | 10 +- client/recurring_invoices.php | 14 +- client/saved_payment_methods.php | 14 +- client/ticket.php | 40 +-- client/ticket_add.php | 2 +- client/ticket_view_all.php | 8 +- client/tickets.php | 6 +- client/unpaid_invoices.php | 20 +- functions/app.php | 4 +- functions/sanitize.php | 2 +- guest/guest_ajax.php | 6 +- guest/guest_approve_ticket_task.php | 22 +- guest/guest_pay_invoice_stripe.php | 22 +- guest/guest_post.php | 148 ++++++------ guest/guest_view_invoice.php | 94 ++++---- guest/guest_view_item.php | 54 ++--- guest/guest_view_quote.php | 70 +++--- guest/guest_view_ticket.php | 30 +-- guest/includes/guest_header.php | 2 +- includes/footer.php | 2 +- includes/header.php | 2 +- includes/page_title.php | 2 +- includes/top_nav.php | 14 +- login.php | 8 +- modals/notifications.php | 6 +- setup/index.php | 2 +- 338 files changed, 3057 insertions(+), 3057 deletions(-) diff --git a/admin/ai_model.php b/admin/ai_model.php index 2eab6bda..1f76e8ea 100644 --- a/admin/ai_model.php +++ b/admin/ai_model.php @@ -60,11 +60,11 @@ $num_rows = mysqli_num_rows($sql); while ($row = mysqli_fetch_assoc($sql)) { $provider_id = intval($row['ai_provider_id']); - $provider_name = nullable_htmlentities($row['ai_provider_name']); + $provider_name = escapeHtml($row['ai_provider_name']); $model_id = intval($row['ai_model_id']); - $model_name = nullable_htmlentities($row['ai_model_name']); - $use_case = nullable_htmlentities($row['ai_model_use_case']); - $prompt = nl2br(nullable_htmlentities($row['ai_model_prompt'])); + $model_name = escapeHtml($row['ai_model_name']); + $use_case = escapeHtml($row['ai_model_use_case']); + $prompt = nl2br(escapeHtml($row['ai_model_prompt'])); ?> diff --git a/admin/ai_provider.php b/admin/ai_provider.php index 1f8eb398..69001c85 100644 --- a/admin/ai_provider.php +++ b/admin/ai_provider.php @@ -50,9 +50,9 @@ $num_rows = mysqli_num_rows($sql); while ($row = mysqli_fetch_assoc($sql)) { $provider_id = intval($row['ai_provider_id']); - $provider_name = nullable_htmlentities($row['ai_provider_name']); - $url = nullable_htmlentities($row['ai_provider_api_url']); - $key = nullable_htmlentities($row['ai_provider_api_key']); + $provider_name = escapeHtml($row['ai_provider_name']); + $url = escapeHtml($row['ai_provider_api_url']); + $key = escapeHtml($row['ai_provider_api_key']); $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ai_model_id') AS ai_model_count FROM ai_models WHERE ai_model_ai_provider_id = $provider_id")); $ai_model_count = intval($row['ai_model_count']); diff --git a/admin/api_keys.php b/admin/api_keys.php index eb21404c..387ae257 100644 --- a/admin/api_keys.php +++ b/admin/api_keys.php @@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -107,10 +107,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $api_key_id = intval($row['api_key_id']); - $api_key_name = nullable_htmlentities($row['api_key_name']); - $api_key_secret = nullable_htmlentities("************" . substr($row['api_key_secret'], -4)); - $api_key_created_at = nullable_htmlentities($row['api_key_created_at']); - $api_key_expire = nullable_htmlentities($row['api_key_expire']); + $api_key_name = escapeHtml($row['api_key_name']); + $api_key_secret = escapeHtml("************" . substr($row['api_key_secret'], -4)); + $api_key_created_at = escapeHtml($row['api_key_created_at']); + $api_key_expire = escapeHtml($row['api_key_expire']); if ($api_key_expire < date("Y-m-d H:i:s")) { $api_key_expire = $api_key_expire . " (Expired)"; } @@ -118,7 +118,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); if ($row['api_key_client_id'] == 0) { $api_key_client = "All Clients"; } else { - $api_key_client = nullable_htmlentities($row['client_name']); + $api_key_client = escapeHtml($row['client_name']); } ?> diff --git a/admin/app_log.php b/admin/app_log.php index a50c6d5b..350a9d72 100644 --- a/admin/app_log.php +++ b/admin/app_log.php @@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php"; // Log Type Filter if (isset($_GET['type']) & !empty($_GET['type'])) { $log_type_query = "AND (app_log_type = '" . sanitizeInput($_GET['type']) . "')"; - $type_filter = nullable_htmlentities($_GET['type']); + $type_filter = escapeHtml($_GET['type']); } else { // Default - any $log_type_query = ''; @@ -19,7 +19,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) { // Log Category Filter if (isset($_GET['category']) & !empty($_GET['catergory'])) { $log_category_query = "AND (app_log_category = '" . sanitizeInput($_GET['category']) . "')"; - $category_filter = nullable_htmlentities($_GET['category']); + $category_filter = escapeHtml($_GET['category']); } else { // Default - any $log_category_query = ''; @@ -50,7 +50,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -67,7 +67,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - + + +
@@ -143,10 +143,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $log_id = intval($row['app_log_id']); - $log_type = nullable_htmlentities($row['app_log_type']); - $log_category = nullable_htmlentities($row['app_log_category']); - $log_details = nullable_htmlentities($row['app_log_details']); - $log_created_at = nullable_htmlentities($row['app_log_created_at']); + $log_type = escapeHtml($row['app_log_type']); + $log_category = escapeHtml($row['app_log_category']); + $log_details = escapeHtml($row['app_log_details']); + $log_created_at = escapeHtml($row['app_log_created_at']); ?> diff --git a/admin/audit_log.php b/admin/audit_log.php index 0cb9a32a..cbac2849 100644 --- a/admin/audit_log.php +++ b/admin/audit_log.php @@ -29,7 +29,7 @@ if (isset($_GET['client']) & !empty($_GET['client'])) { // Log Type Filter if (isset($_GET['type']) & !empty($_GET['type'])) { $log_type_query = "AND (log_type = '" . sanitizeInput($_GET['type']) . "')"; - $type_filter = nullable_htmlentities($_GET['type']); + $type_filter = escapeHtml($_GET['type']); } else { // Default - any $log_type_query = ''; @@ -39,7 +39,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) { // Log Action Filter if (isset($_GET['action']) & !empty($_GET['action'])) { $log_action_query = "AND (log_action = '" . sanitizeInput($_GET['action']) . "')"; - $action_filter = nullable_htmlentities($_GET['action']); + $action_filter = escapeHtml($_GET['action']); } else { // Default - any $log_action_query = ''; @@ -73,7 +73,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -90,7 +90,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC"); while ($row = mysqli_fetch_assoc($sql_clients_filter)) { $client_id = intval($row['client_id']); - $client_name = nullable_htmlentities($row['client_name']); + $client_name = escapeHtml($row['client_name']); ?> - - - + + +
@@ -227,22 +227,22 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $log_id = intval($row['log_id']); - $log_type = nullable_htmlentities($row['log_type']); - $log_action = nullable_htmlentities($row['log_action']); - $log_description = nullable_htmlentities($row['log_description']); - $log_ip = nullable_htmlentities($row['log_ip']); - $log_user_agent = nullable_htmlentities($row['log_user_agent']); + $log_type = escapeHtml($row['log_type']); + $log_action = escapeHtml($row['log_action']); + $log_description = escapeHtml($row['log_description']); + $log_ip = escapeHtml($row['log_ip']); + $log_user_agent = escapeHtml($row['log_user_agent']); $log_user_os = getOS($log_user_agent); $log_user_browser = getWebBrowser($log_user_agent); - $log_created_at = nullable_htmlentities($row['log_created_at']); + $log_created_at = escapeHtml($row['log_created_at']); $user_id = intval($row['user_id']); - $user_name = nullable_htmlentities($row['user_name']); + $user_name = escapeHtml($row['user_name']); if (empty($user_name)) { $user_name_display = "-"; } else { $user_name_display = $user_name; } - $client_name = nullable_htmlentities($row['client_name']); + $client_name = escapeHtml($row['client_name']); $client_id = intval($row['client_id']); if (empty($client_name)) { $client_name_display = "-"; diff --git a/admin/category.php b/admin/category.php index 16bca100..9e692808 100644 --- a/admin/category.php +++ b/admin/category.php @@ -28,14 +28,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

- Categories + Categories

- +
- +
+ placeholder="Search Categories ">
@@ -143,9 +143,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $category_id = intval($row['category_id']); - $category_name = nullable_htmlentities($row['category_name']); - $category_description = nullable_htmlentities($row['category_description']); - $category_color = nullable_htmlentities($row['category_color']); + $category_name = escapeHtml($row['category_name']); + $category_description = escapeHtml($row['category_description']); + $category_color = escapeHtml($row['category_color']); ?> diff --git a/admin/contract_template.php b/admin/contract_template.php index f8098658..c1aa5dc1 100644 --- a/admin/contract_template.php +++ b/admin/contract_template.php @@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -61,28 +61,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); -
+
diff --git a/admin/custom_link.php b/admin/custom_link.php index 08eefb79..0d930489 100644 --- a/admin/custom_link.php +++ b/admin/custom_link.php @@ -30,7 +30,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -74,9 +74,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_assoc($sql)) { $custom_link_id = intval($row['custom_link_id']); - $custom_link_name = nullable_htmlentities($row['custom_link_name']); - $custom_link_uri = nullable_htmlentities($row['custom_link_uri']); - $custom_link_icon = nullable_htmlentities($row['custom_link_icon']); + $custom_link_name = escapeHtml($row['custom_link_name']); + $custom_link_uri = escapeHtml($row['custom_link_uri']); + $custom_link_icon = escapeHtml($row['custom_link_icon']); $custom_link_new_tab = intval($row['custom_link_new_tab']); if ($custom_link_new_tab == 1 ) { $custom_link_new_tab_display = ""; diff --git a/admin/document_template.php b/admin/document_template.php index 5b2d808a..131ac3c9 100644 --- a/admin/document_template.php +++ b/admin/document_template.php @@ -31,7 +31,7 @@
- +
@@ -68,12 +68,12 @@ while ($row = mysqli_fetch_assoc($sql)) { $document_template_id = intval($row['document_template_id']); - $document_template_name = nullable_htmlentities($row['document_template_name']); - $document_template_description = nullable_htmlentities($row['document_template_description']); - $document_template_content = nullable_htmlentities($row['document_template_content']); - $document_template_created_by_name = nullable_htmlentities($row['user_name']); - $document_template_created_at = nullable_htmlentities($row['document_template_created_at']); - $document_template_updated_at = nullable_htmlentities(getFallback($row['document_template_updated_at'])); + $document_template_name = escapeHtml($row['document_template_name']); + $document_template_description = escapeHtml($row['document_template_description']); + $document_template_content = escapeHtml($row['document_template_content']); + $document_template_created_by_name = escapeHtml($row['user_name']); + $document_template_created_at = escapeHtml($row['document_template_created_at']); + $document_template_updated_at = escapeHtml(getFallback($row['document_template_updated_at'])); ?> diff --git a/admin/document_template_details.php b/admin/document_template_details.php index fa6c3f51..6e8503eb 100644 --- a/admin/document_template_details.php +++ b/admin/document_template_details.php @@ -25,11 +25,11 @@ if (mysqli_num_rows($sql_document) == 0) { $row = mysqli_fetch_assoc($sql_document); -$document_template_name = nullable_htmlentities($row['document_template_name']); -$document_template_description = nullable_htmlentities($row['document_template_description']); +$document_template_name = escapeHtml($row['document_template_name']); +$document_template_description = escapeHtml($row['document_template_description']); $document_template_content = $purifier->purify($row['document_template_content']); -$document_template_created_at = nullable_htmlentities($row['document_template_created_at']); -$document_template_updated_at = nullable_htmlentities($row['document_template_updated_at']); +$document_template_created_at = escapeHtml($row['document_template_created_at']); +$document_template_updated_at = escapeHtml($row['document_template_updated_at']); ?> diff --git a/admin/identity_provider.php b/admin/identity_provider.php index 6a39905e..d3f03114 100644 --- a/admin/identity_provider.php +++ b/admin/identity_provider.php @@ -33,7 +33,7 @@ require_once "includes/inc_all_admin.php";
- +
@@ -43,7 +43,7 @@ require_once "includes/inc_all_admin.php";
- +
diff --git a/admin/includes/side_nav.php b/admin/includes/side_nav.php index 5d7b224a..07b82578 100644 --- a/admin/includes/side_nav.php +++ b/admin/includes/side_nav.php @@ -1,5 +1,5 @@ -