--- a/batch_upload.php
+++ b/batch_upload.php
@@ -118,7 +118,7 @@
 					$filename = stripslashes($filename);
 					$filename = clean($filename);
 				
-					if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
+					if (strlen($hash) != 40) || !verifyHash($hash))
 					{
 						echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
 						$error_status = false;

--- a/dltorrent.php
+++ b/dltorrent.php
@@ -7,7 +7,7 @@
 if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
 {
 	//check fails
-	header("Location: authenticate.php?status=session");
+	header("Location: authenticate.php?status=error");
 	exit();
 }
 

--- a/newtorrents.php
+++ b/newtorrents.php
@@ -36,7 +36,7 @@
 	require ("config.php");
 	$tracker_url = $announce_url0 OR $announce_url1 OR $announce_url2 OR $announce_url3 OR $announce_url4;
 	
-	$hash = strtolower($_POST["hash"]);
+	$hash = strtolower(htmlentities($_POST["hash"], ENT_QUOTES, "UTF-8"));
 
 	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Couldn't connect to the database, contact the administrator</p>");
 	mysql_select_db($database) or die(errorMessage() . "Can't open the database.</p>");
@@ -184,7 +184,7 @@
 	$filename = htmlspecialchars(clean($filename));
 	$url = htmlspecialchars(mysql_real_escape_string($url));
 
-	if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
+	if ((strlen($hash) != 40) || !verifyHash($hash))
 	{
 		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
 		endOutput();