5 files changed, 13 insertions, 15 deletions

@@ -87,7 +87,7 @@ while ($getposts3[$i] = mysql_fetch_array($getposts2))
 
         $template->adds_ref_sub($curID, 'SMALL',array(  'DATE' => date('m-d-Y',strtotime($getposts3[$i]['pubDate'])),
                                                         'CODED' => $getposts3[$i]['slug'],
-                                                        'TITLE' => doAprilFoolsDay(htmlentities(stripslashes($getposts3[$i]['title'])))));
+                                                        'TITLE' => doAprilFoolsDay(htmlspecialchars($getposts3[$i]['title']))));
         $i++;
 }
 if ($i==0)
@@ -46,7 +46,7 @@ if (isset($_GET['post']))
         {
                 updatePop($getpost3['id'],'views');
 
-                $title = stripslashes(htmlentities($getpost3['title'])) . ' - Blog Archive';
+                $title = htmlspecialchars($getpost3['title']) . ' - Blog Archive';
 
                 $getback = "SELECT * FROM updates WHERE id < " . $getpost3['id'] . " ORDER BY id DESC LIMIT 0,1";
                 $getback2 = mysql_query($getback);
@@ -54,7 +54,7 @@ if (isset($_GET['post']))
                 if (isset($getback3['title']))
                 {
                         $template->adds_block('BACK', array(    'CODED' => $getback3['slug'],
-                                                                'TITLE' => doAprilFoolsDay(htmlentities(stripslashes($getback3['title'])))));
+                                                                'TITLE' => doAprilFoolsDay(htmlspecialchars($getback3['title']))));
                 }
 
                 $getnext = "SELECT * FROM updates WHERE id > " . $getpost3['id'] . " ORDER BY id ASC LIMIT 0,1";
@@ -63,7 +63,7 @@ if (isset($_GET['post']))
                 if (isset($getnext3['title']))
                 {
                         $template->adds_block('NEXT', array(    'CODED' => $getnext3['slug'],
-                                                                'TITLE' => doAprilFoolsDay(htmlentities(stripslashes($getnext3['title'])))));
+                                                                'TITLE' => doAprilFoolsDay(htmlspecialchars($getnext3['title']))));
                 }
 
                 $template->add_ref(0, 'POST', array(    'ID' => $getpost3['id'],
@@ -72,10 +72,10 @@ if (isset($_GET['post']))
                                                         'MONTH' => date('M',strtotime($getpost3['pubDate'])),
                                                         'DAY' => date('d',strtotime($getpost3['pubDate'])),
                                                         'CODED' => $getpost3['slug'],
-                                                        'TITLE' => doAprilFoolsDay(htmlentities(stripslashes($getpost3['title']))),
+                                                        'TITLE' => doAprilFoolsDay(htmlspecialchars($getpost3['title'])),
                                                         'AUTHOR' => $getpost3['author'],
                                                         'RATING' => $getpost3['rating'],
-                                                        'TEXT' => parseText(stripslashes($getpost3['text']))));
+                                                        'TEXT' => parseText($getpost3['text'])));
 
                 $tags = getTags($getpost3['id']);
                 foreach ($tags as $tag)
@@ -121,8 +121,6 @@ if (isset($_GET['post']))
 
                 $page_id = 'updates-' . $getpost3['id'];
                 include('includes/comments.php');
-
-                displayRelated($getpost3['title'], $getpost3['id']);
         } else {
                 generateError('404');
         }
@@ -171,12 +169,12 @@ if (isset($_GET['post']))
                                                                 'MONTH' => date('M',strtotime($getpost3['pubDate'])),
                                                                 'DAY' => date('d',strtotime($getpost3['pubDate'])),
                                                                 'CODED' => $getpost3['slug'],
-                                                                'TITLE' => doAprilFoolsDay(htmlentities(stripslashes($getpost3['title']))),
+                                                                'TITLE' => doAprilFoolsDay(htmlspecialchars($getpost3['title'])),
                                                                 'AUTHOR' => $getpost3['author'],
                                                                 'PLURALCOMMENT' => (isset($plural) ? $plural : ''),
                                                                 'COMMENTS' => $comText,
                                                                 'RATING' => $getpost3['rating'],
-                                                                'TEXT' => parseText(stripslashes($getpost3['text']))));
+                                                                'TEXT' => parseText($getpost3['text'])));
 
                 $tags = getTags($getpost3['id']);
                 foreach ($tags as $tag)
@@ -68,7 +68,7 @@ if (!isset($_POST['id']))
                                                                 $template = new FITemplate('new-comment');
                                                                 $template->add('ID', $cid);
                                                                 $template->add('CODEDEMAIL', md5(strtolower($getanon3['email'])));
-                                                                $template->add('TEXT', stripslashes($_POST['comment']));
+                                                                $template->add('TEXT', $_POST['comment']);
                                                                 $template->add('USERNAME', $getanon3['username']);
                                                                 $template->add('DATE', date("F jS Y \a\\t g:i:s a"));
                                                                 $template->display();
@@ -108,7 +108,7 @@ if (!isset($_POST['id']))
                         $template = new FITemplate('new-comment');
                         $template->add('ID', $cid);
                         $template->add('CODEDEMAIL', md5(strtolower($getuser3['user_email'])));
-                        $template->add('TEXT', stripslashes($_POST['comment']));
+                        $template->add('TEXT', $_POST['comment']);
                         $template->add('USERNAME', getSessionUsername());
                         $template->add('DATE', date("F jS Y \a\\t g:i:s a"));
                         $template->display();
@@ -70,7 +70,7 @@ if (isset($_GET['id']) && !(is_numeric($_GET['id'])))
         $template = new FITemplate('quotes/add');
         if (isset($_GET['submit']))
         {
-                $template->adds_block('SUBMITTED',array('QUOTE' => str_replace("\n","<br />",htmlspecialchars(stripslashes($_POST['rash_quote'])))));
+                $template->adds_block('SUBMITTED',array('QUOTE' => str_replace("\n","<br />",htmlspecialchars($_POST['rash_quote']))));
                 if (!isLoggedIn())
                 {
                         $insquote = "INSERT INTO rash_queue (quote) VALUES(\"" . mysql_real_escape_string(htmlspecialchars($_POST['rash_quote'])) . "\")";
@@ -236,7 +236,7 @@ function quote_generation($query, $origin, $page = 1, $quote_limit = 50, $page_l
                 $template->add_ref($curID,'QUOTES',array(       'NUMBER' => $getquotes3[$i]['id'],
                                                                 'RATING' => $getquotes3[$i]['rating'],
                                                                 'DATE' => ($getquotes3[$i]['date'] != 0 ? date('F jS Y \a\\t g:i:s a', $getquotes3[$i]['date']) : ''),
-                                                                'QUOTE' => doAprilFoolsDay(str_replace("\n","<br />",htmlspecialchars(stripslashes($getquotes3[$i]['quote'])))),
+                                                                'QUOTE' => doAprilFoolsDay(str_replace("\n","<br />",htmlspecialchars($getquotes3[$i]['quote']))),
                                                                 'COMMENTS' => $comments));
 
                 if (($gettrack3['ip'] != $_SERVER['REMOTE_ADDR']) || (array_search($getquotes3[$i]['id'],$trackArr) === FALSE))
@@ -44,7 +44,7 @@ if (!isAdmin())
                                                         'TITLE' => $getpost3['title'],
                                                         'AUTHOR' => $getpost3['author'],
                                                         'RATING' => $getpost3['rating'],
-                                                        'TEXT' => parseText(stripslashes($getpost3['text']))));
+                                                        'TEXT' => parseText($getpost3['text'])));
 
                 $tags = getTags($getpost3['id']);
                 foreach ($tags as $tag)