From 4bf8d8d9705254285e1c2e52222314075f02a6cb Mon Sep 17 00:00:00 2001
From: Xuxfff <1683793776@qq.com>
Date: Wed, 12 Oct 2022 14:05:56 +0800
Subject: [PATCH] =?UTF-8?q?fix:=E4=BF=AE=E5=A4=8D=E4=BA=86xss=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Reset_password.php   | 4 ++--
 recover_password.php | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Reset_password.php b/Reset_password.php
index 7af1740..02a277e 100644
--- a/Reset_password.php
+++ b/Reset_password.php
@@ -8,8 +8,8 @@
 
 
 include 'Header.php';
-$token=$_GET['token'];
-$email=$_GET['email'];
+$token=htmlspecialchars($_GET['token']);
+$email=htmlspecialchars($_GET['email']);
 ?>
 
 <div class="row">
diff --git a/recover_password.php b/recover_password.php
index 0512f13..d9ae8a2 100644
--- a/recover_password.php
+++ b/recover_password.php
@@ -27,9 +27,9 @@ include 'Header.php';
       <div class="panel-body">
         <form method="post" action="Script.php">
         <input type="hidden" name="frm_recover_password" value="true"/>
-        Student number  <input type="text" name="sno" placeholder="Enter your student number" class="form-control" required="required" value="<?php echo $_SESSION['student_number']; ?>">
+        Student number  <input type="text" name="sno" placeholder="Enter your student number" class="form-control" required="required" value="<?php echo htmlspecialchars($_SESSION['student_number']); ?>">
 	<br/>
-        Email  <input type="text" name="email" placeholder="Enter your email address" class="form-control" required="required" value="<?php echo $_SESSION['user_email']; ?>">
+        Email  <input type="text" name="email" placeholder="Enter your email address" class="form-control" required="required" value="<?php echo htmlspecialchars($_SESSION['user_email']); ?>">
 	<br/>
         <input type="submit" class="btn-primary" value="Recover">
           
@@ -38,7 +38,7 @@ include 'Header.php';
 <?php
 
 if(isset($_SESSION['info_recover_password'])) {
-  echo  '<hr><div class="alert alert-danger" role="alert">'.$_SESSION['info_recover_password'].'</div>';
+  echo  '<hr><div class="alert alert-danger" role="alert">'.htmlspecialchars($_SESSION['info_recover_password']).'</div>';
   $_SESSION['info_recover_password']=null;
 }