X-Git-Url: https://git.p6c8.net/form-email.git/blobdiff_plain/f77ec4e3fb74940eeabdf816a99664ec5e532f64..48d0c07a90a64c489199182f3c0757153f12d363:/form-email/functions.php

diff --git a/form-email/functions.php b/form-email/functions.php
index e353da8..e746a7e 100644
--- a/form-email/functions.php
+++ b/form-email/functions.php
@@ -7,7 +7,7 @@
 # geschrieben wurde.
 #
 # Autor:            Patrick Canterino <patrick@patshaping.de>
-# Letzte Aenderung: 3.12.2011
+# Letzte Aenderung: 12.12.2011
 #
 # Copyright (C) 2002-2011 Patrick Canterino
 #
@@ -66,8 +66,8 @@ function formdata($param) {
 #
 # Rueckgabe: Bearbeiteter Text (String)
 
-function &plain(&$text,$linebreak='<br>') {
-    $htmltext = htmlentities($text);
+function plain($text,$linebreak='<br>') {
+    $htmltext = htmlspecialchars($text);
     $htmltext = preg_replace("/\015\012|\012|\015/",$linebreak,$htmltext);
 
     for($x=0;$x<strlen($htmltext);$x++) {
@@ -103,13 +103,21 @@ function semicolon_split($string) {
 #
 # Parameter: Fehlermeldung
 
-function show_fatal(&$errmsg) {
+function show_fatal($errmsg,$vars=array()) {
     global $tpl_fatal;
 
     $tpl = new Template;
     $tpl->read_file($tpl_fatal);
 
-    $tpl->fillin('ERROR',$errmsg);
+    if(sizeof($vars) > 0) {
+        while(list($var,$content) = each($vars)) {
+            $errmsg = str_replace('{'.$var.'}',htmlspecialchars($content),$errmsg);
+        }
+    }
+
+    $tpl->set_var('ERROR',$errmsg);
+
+    $tpl->parse();
 
     print $tpl->get_template();
     exit;
@@ -122,19 +130,25 @@ function show_fatal(&$errmsg) {
 #
 # Parameter: Fehlermeldung
 
-function show_user_error(&$errmsg) {
-    global $captcha_enable, $email, $name, $subject, $text, $tpl_user_error;
+function show_user_error($errmsg) {
+    global $captcha_enable, $email, $name, $subject, $text, $user_fields, $tpl_user_error;
 
     $tpl = new Template;
     $tpl->read_file($tpl_user_error);
 
     $tpl->parse_if_block('CAPTCHA',$captcha_enable);
 
-    $tpl->set_var('EMAIL',  htmlentities($email));
+    $tpl->set_var('EMAIL',  htmlspecialchars($email));
     $tpl->set_var('ERROR',  $errmsg);
-    $tpl->set_var('NAME',   htmlentities($name));
-    $tpl->set_var('SUBJECT',htmlentities($subject));
-    $tpl->set_var('TEXT',   htmlentities($text));
+    $tpl->set_var('NAME',   htmlspecialchars($name));
+    $tpl->set_var('SUBJECT',htmlspecialchars($subject));
+    $tpl->set_var('TEXT',   htmlspecialchars($text));
+
+    reset($user_fields);
+
+    while(list($user_field,$user_field_data) = each($user_fields)) {
+        $tpl->set_var($user_field_data['tpl_var'],htmlspecialchars(formdata($user_field)));
+    }
 
     $tpl->parse();