Question for checkout_confirmation/header_php.php XSS comment field fix

**cstdenis** · 2 Dec 2015, 07:23 PM

The diff for this is

Code:

-$_SESSION['comments'] = $_POST['comments'];
+$_SESSION['comments'] = zen_output_string_protected($_POST['comments']);

which works fine for 1.5.4, but 1.3.9, the existing code is

Code:

$_SESSION['comments'] = zen_db_prepare_input($_POST['comments']);

Should the zen_db_prepare_input be replaced by zen_output_string_protected, or should they be merged in some way such as zen_db_prepare_input(zen_output_string_protected($_POST['comments'])) or zen_output_string_protected(zen_db_prepare_input($_POST['comments']))?

I don't want to accidentally introduce an sql injection vulnerability here.

**DrByte** · 2 Dec 2015, 07:31 PM

Just use:
$_SESSION['comments'] = zen_output_string_protected($_POST['comments']);

... and BE SURE to plan for an upgrade in the next couple months. Seriously.

(Edit: I see in another forum thread you've said you're working on your upgrade. Kudos.)