From 29dff39bf1e5cfcd90bc783142826f65de9a6334 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Sat, 23 Jun 2012 17:17:09 +0100
Subject: [PATCH] Cleaning strings

Getting GET vars cleaned before use
---
 lib/multiple-results.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/multiple-results.php b/lib/multiple-results.php
index 131f66d..ac7642d 100644
--- a/lib/multiple-results.php
+++ b/lib/multiple-results.php
@@ -22,7 +22,7 @@
 var resultsDisplay = "";
 var foundTabArray = [];
 var startTab = top.ICEcoder.selectedTab;
-var rExp = new RegExp("<?php echo $_GET['find']; ?>","g");
+var rExp = new RegExp("<?php echo strClean($_GET['find']); ?>","g");
 for (var i=1;i<=top.ICEcoder.openFiles.length;i++) {
 	top.ICEcoder.switchTab(i);
 	var cM = top.ICEcoder.getcMInstance();
@@ -46,7 +46,7 @@ if (foundTabArray.length==0) {alert('No matches found')};
 if (foundTabArray.length!=0) {document.getElementById('replaceAll').style.opacity = 1};
 <?php ;}; ?>
 foundTabArray.length >= 2 ? plural = "s" : plural = "";
-document.getElementById('title').innerHTML = "'<?php echo $_GET['find']; ?>' found in "+foundTabArray.length+" file"+plural;
+document.getElementById('title').innerHTML = "'<?php echo strClean($_GET['find']); ?>' found in "+foundTabArray.length+" file"+plural;
 document.getElementById('results').innerHTML = resultsDisplay;
 
 var gotoTab = function(tab) {