From 26d54cfa9bdc15b8718fee586602a861307486de Mon Sep 17 00:00:00 2001
From: Rory M <roddux@gmail.com>
Date: Fri, 22 Apr 2016 14:27:21 +0100
Subject: [PATCH] Fix for XSS bug

I actually tested this one! it works.
My apologies for the previous, non-working commits-- I had to refresh my knowledge of PHP.
---
 api.php | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/api.php b/api.php
index f8a590cf..85b282ea 100644
--- a/api.php
+++ b/api.php
@@ -47,6 +47,18 @@
         $data = array_merge($data, getAllQueries());
     }
 
-    foreach ($data as &$d) $d = htmlspecialchars($d);
+    function filterArray(&$a) {
+	    $sanArray = array();
+	    foreach ($a as $k=>$v) {
+	        if (is_array($v)) {
+	            $sanArray[htmlspecialchars($k)] = filterArray($v);
+            } else {
+	            $sanArray[htmlspecialchars($k)] = htmlspecialchars($v);
+            }
+	    }
+	    return $sanArray;
+    }
+    
+    $data = filterArray($data);
     echo json_encode($data);
 ?>