@@ -13,7 +13,7 @@ if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])

 //if hash isn't of length 40, don't even bother connecting to database

-if (strlen($_GET['hash']) != 40)

+if (strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40)

 {

 	header("index.php"); 	

   	exit();

@@ -133,14 +133,14 @@ if (file_exists("rss/rss.xml"))

 	<?php

 	//Cleanup page number to prevent XSS

 	if (isset($_GET["page_number"])) {

-		$_GET["page_number"] = htmlspecialchars($_GET["page_number"]);

+		$_GET["page_number"] = htmlentities($_GET["page_number"], ENT_QUOTES);

 	} else {

 		$_GET["page_number"] = "";

 	}

 	$scriptname = htmlspecialchars($scriptname);

 	if (!isset($_GET["activeonly"]))

-		$scriptname = $scriptname . "activeonly=	yes&";

+		$scriptname = $scriptname . "activeonly=yes&";

 	if (isset($_GET["seededonly"]) && !isset($_GET["activeonly"]))

 	{

 		$scriptname = $scriptname . "seededonly=yes&";