--- a/batch_upload.php
+++ b/batch_upload.php
@@ -118,7 +118,7 @@
 					$filename = stripslashes($filename);
 					$filename = clean($filename);
 				
-					if ((strlen($hash) != 40) || !verifyHash($hash))
+					if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
 					{
 						echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
 						$error_status = false;