@@ -118,7 +118,7 @@ if (isset($_FILES["zipfile"]) && $_FILES["zipfile"]["error"] != 4 && isset($_FIL

 					$filename = stripslashes($filename);

 					$filename = clean($filename);

-					if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))

+					if (strlen($hash) != 40) || !verifyHash($hash))

 					{

 						echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";

 						$error_status = false;

@@ -7,7 +7,7 @@ session_start();

 if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])

 {

 	//check fails

-	header("Location: authenticate.php?status=session");

+	header("Location: authenticate.php?status=error");

 	exit();

 }

@@ -36,7 +36,7 @@ function addTorrent()

 	require ("config.php");

 	$tracker_url = $announce_url0 OR $announce_url1 OR $announce_url2 OR $announce_url3 OR $announce_url4;

-	$hash = strtolower($_POST["hash"]);

+	$hash = strtolower(htmlentities($_POST["hash"], ENT_QUOTES, "UTF-8"));

 	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Couldn't connect to the database, contact the administrator</p>");

 	mysql_select_db($database) or die(errorMessage() . "Can't open the database.</p>");

@@ -184,7 +184,7 @@ function addTorrent()

 	$filename = htmlspecialchars(clean($filename));

 	$url = htmlspecialchars(mysql_real_escape_string($url));

-	if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))

+	if ((strlen($hash) != 40) || !verifyHash($hash))

 	{

 		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";

 		endOutput();