HTML escaping on data retrieval.

application/entity/Custom_Filter.php

@@ -66,8 +66,8 @@
             $this->id = $r["id"];
             $this->uid = $r["uid"];
             $this->page = $r["page"];
-            $this->name = $r["name"];
-            $this->description = $r["description"];
+            $this->name = e($r["name"]);
+            $this->description = e($r["description"]);
             $this->condition = $r["condition"];
         }
 

application/entity/Guild.php

@@ -91,14 +91,14 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
                 $this->level = $r["level"];
                 $this->experience = $r["experience"];
                 $this->recruiting = $r["recruiting"];
                 $this->total_members = $r["members"];
                 $this->leader = $r["leader"];
-                $this->comment = $r["comment"];
-                $this->notice = $r["notice"];
+                $this->comment = e($r["comment"]);
+                $this->notice = e($r["notice"]);
             }
             $s =
               "SELECT id " .

application/entity/Guild_Member.php

@@ -98,7 +98,7 @@
             if ($r){
                 $this->id = $r["id"];
                 $this->guild = $r["guild"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
                 $this->level = $r["level"];
                 $this->grade = $r["grade"];
                 $this->rating = $r["rating"];

application/entity/Inventory.php

@@ -78,14 +78,14 @@
             if ($r["type"] == $INVENTORY_TYPE["GUILD_MONSTER_PIECE"] || $r["type"] == $INVENTORY_TYPE["MONSTER_PIECE"]){
                 $this->is_monster_pices = true;
                 $this->id = new K_Unit($this->db, $r["id"]);
-                $this->name = $this->id->title . " Pieces";
-                $this->description = $this->id->title . " Pieces";
+                $this->name = e($this->id->title) . " Pieces";
+                $this->description = e($this->id->title) . " Pieces";
             }
             else{
                 $this->is_monster_pices = false;
                 $this->id = $r["id"];
-                $this->name = $r["name"];
-                $this->description = $r["description"];
+                $this->name = e($r["name"]);
+                $this->description = e($r["description"]);
             }
         }
 

application/entity/K_Area.php

@@ -53,7 +53,7 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->type = $r["type"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
             }
             elseif($this->id > 1000){
                 $this->type = $AREA_TYPE["CAIROS_DUNGEON"];

application/entity/K_Building.php

@@ -48,8 +48,8 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
-                $this->description = $r["description"];
+                $this->name = e($r["name"]);
+                $this->description = e($r["description"]);
             }
         }
 

application/entity/K_Decoration.php

@@ -83,8 +83,8 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
-                $this->description = $r["description"];
+                $this->name = e($r["name"]);
+                $this->description = e($r["description"]);
                 $this->area = $r["area"];
                 $this->stat = $r["affected_stat"];
                 $this->element = $r["element"];

application/entity/K_Effect.php

@@ -53,9 +53,9 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
                 $this->is_buff = $r["is_buff"];
-                $this->description = $r["description"];
+                $this->description = e($r["description"]);
             }
         }
 

application/entity/K_Guild_Skill.php

@@ -55,7 +55,7 @@
                 $this->id = $r["id"];
                 $this->group = $r["skill_group"];
                 $this->level = $r["level"];
-                $this->effect = $r["effect"];
+                $this->effect = e($r["effect"]);
             }
         }
 

application/entity/K_Guild_Skill_Group.php

@@ -53,8 +53,8 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
-                $this->description = $r["description"];
+                $this->name = e($r["name"]);
+                $this->description = e($r["description"]);
             }
             $s =
               "SELECT id " .

application/entity/K_Rune_Set.php

@@ -53,9 +53,9 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
                 $this->amount = $r["amount"];
-                $this->description = $r["description"];
+                $this->description = e($r["description"]);
             }
         }
 

application/entity/K_Skill.php

@@ -106,15 +106,15 @@
             $q = $this->db->query($s);
             $r = $q->fetchArray(SQLITE3_ASSOC);
             $this->id = $r["id"];
-            $this->name = $r["name"];
-            $this->description = $r["description"];
+            $this->name = e($r["name"]);
+            $this->description = e($r["description"]);
             $this->slot = $r["slot"];
             $this->cooltime = $r["cooltime"];
             $this->hits = $r["hits"];
             $this->passive = $r["passive"];
             $this->aoe = $r["aoe"];
             $this->max_level = $r["max_level"];
-            $this->multiplier_formula = $r["multiplier_formula"];
+            $this->multiplier_formula = e($r["multiplier_formula"]);
             $s =
               "SELECT " .
               "  skill, " .

application/entity/K_Skill_Level.php

@@ -51,7 +51,7 @@
             if ($r){
                 $this->skill = $r["skill"];
                 $this->level = $r["level"];
-                $this->description = $r["description"];
+                $this->description = e($r["description"]);
             }
         }
     }

application/entity/K_Source.php

@@ -54,8 +54,8 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             if ($r){
                 $this->id = $r["id"];
-                $this->name = $r["name"];
-                $this->description = $r["description"];
+                $this->name = e($r["name"]);
+                $this->description = e($r["description"]);
                 $this->farmable_source = $r["farmable"];
             }
         }

application/entity/K_Unit.php

@@ -265,7 +265,7 @@
             if ($r){
                 $this->id = $r["id"];
                 $this->family = $r["family"];
-                $this->name = $r["name"];
+                $this->name = e($r["name"]);
                 $this->element = $r["element"];
                 switch($this->element){
                     case $ELEMENT["WATER"]:
@@ -306,7 +306,7 @@
                 $this->natural_stars = $r["natural_stars"];
                 $this->obtainable = $r["obtainable"];
                 $this->can_awaken = $r["can_awaken"];
-                $this->awaken_bonus = $r["awaken_bonus"];
+                $this->awaken_bonus = e($r["awaken_bonus"]);
                 $this->skill_ups_to_max = $r["skill_ups_to_max"];
                 if (strlen($r["leader_skill"]) > 0){
                     $this->leader_skill = new K_Leader_Skill($this->db, $r["leader_skill"]);

application/entity/Team.php

@@ -76,8 +76,8 @@
             $r = $q->fetchArray(SQLITE3_ASSOC);
             $this->uid = $r["uid"];
             $this->id = $r["id"];
-            $this->name = $r["name"];
-            $this->description = $r["description"];
+            $this->name = e($r["name"]);
+            $this->description = e($r["description"]);
             $this->area = new K_Area($this->db, $r["area"], $r["area_type"]);
             $this->stage = $r["stage"];
             if ($complete){

application/entity/Unit.php

@@ -459,7 +459,6 @@
          *
          */
         public function are_skills_maxed(){
-            error_log('MAXED??');
             $maxed = true;
             for ($i = 0; $i < sizeof($this->unit->skill); $i ++){
                 error_log("    " . $this->skill_levels[$i] . "/" . $this->unit->skill[$i]->max_level);

application/helper/html.php

@@ -1,5 +1,15 @@
 <?php
 
+    /**
+     * Alias for htmlspecialchars([input], ENT_QUOTES)
+     *
+     * @param input Text to escape.
+     * @return Escaped text.
+     */
+    function e($input){
+       return htmlspecialchars($input, ENT_QUOTES);
+    }
+
     /**
      * Generates a monster panel.
      *