Pages: [1]
Author Topic: Escape descriptions ?  (Read 223 times)
Customers
Full Member
*

Karma: 0
Posts: 67


Email
on: Mar 17, 10, 12:19 AM

I found a game from Mochi today that had a link embedded in the game description. Like this:

FLIP the CARDS against the borders to SCORE! > <a href="http://www.nalindesign.com" title="Award-winning freelance web designer + graphic designer + logo designer">Hire an award-winning freelance web designer + graphic designer + logo designer</a> <

On Mochi's site, it looks just like that. On my PAS site, it turns into a real clickable link. How do I prevent that? (The game is called "The Desk").


Logged
Administrator
Sr. Member
*

Karma: 7
Posts: 486


Email
Reply #1 on: Mar 17, 10, 12:32 AM

first of all, report this tos violation to mochi admins, I'm almost sure links like that are not allowed in descriptions.

inside PAS edit the block_gamelist.php file:
find line containing
Code:
"DESCRIPTION" => $resGames[$nCurGame]["description"]
and replace it by this line:
Code:
"DESCRIPTION" => strip_tags($resGames[$nCurGame]["description"])
Logged
Customers
Full Member
*

Karma: 0
Posts: 67


Email
Reply #2 on: Mar 18, 10, 11:29 AM

I did report them.
Thank you for the code.
Logged
Customers
Full Member
*

Karma: 0
Posts: 67


Email
Reply #3 on: Mar 30, 10, 09:38 PM

Is there a place I can strip tags when the game is imported? Otherwise there is risk of SQL injection via the Mochi description.
Logged
Administrator
Sr. Member
*

Karma: 7
Posts: 486


Email
Reply #4 on: Mar 30, 10, 11:52 PM

search for
Code:
$keywords = mysql_escape_string
in the admin/mochiimporter.php file and change it the same way.

I'd also suggest you to contact mochimedia and ask them is that even possible to get sql injection through tags in game feed.
Logged
Pages: [1]
 
Jump to: