diff --git a/e107_handlers/e_parse_class.php b/e107_handlers/e_parse_class.php index 8d9927dee..eb1d335a1 100644 --- a/e107_handlers/e_parse_class.php +++ b/e107_handlers/e_parse_class.php @@ -502,7 +502,8 @@ class e_parse extends e_parser foreach ($data as $key => $var) { //Fix - sanitize keys as well - $ret[$this->toDB($key, $nostrip, $no_encode, $mod, $parm)] = $this->toDB($var, $nostrip, $no_encode, $mod, $parm); + $key = filter_var($key,FILTER_SANITIZE_STRING); + $ret[$key] = $this->toDB($var, $nostrip, $no_encode, $mod, $parm); } return $ret; @@ -515,6 +516,11 @@ class e_parse extends e_parser $data = stripslashes($data); } + if(intval($data) === $data) // simple integer. + { + return $data; + } + if ($mod !== 'pReFs') //XXX We're not saving prefs. { @@ -550,7 +556,7 @@ class e_parse extends e_parser { $no_encode = true; } - + if($parm !== null && is_numeric($parm) && !check_class($core_pref->get('post_html'), '', $parm)) { $no_encode = false; @@ -571,8 +577,8 @@ class e_parse extends e_parser $ret = preg_replace("/&#(\d*?);/", "&#\\1;", $data); } - - // XXX - php_bbcode has been deprecated. + + // XXX - php_bbcode has been deprecated. if ((strpos($mod, 'no_php') !== false) || !check_class($core_pref->get('php_bbcode'))) { $ret = preg_replace("#\[(php)#i", "[\\1", $ret);