--- a/newtorrents.php
+++ b/newtorrents.php
@@ -184,7 +184,7 @@
 	$filename = htmlspecialchars(clean($filename));
 	$url = htmlspecialchars(mysql_real_escape_string($url));
 
-	if ((strlen($hash) != 40) || !verifyHash($hash))
+	if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
 	{
 		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
 		endOutput();