--- a/dltorrent.php
+++ b/dltorrent.php
@@ -13,7 +13,7 @@
 
 
 //if hash isn't of length 40, don't even bother connecting to database
-if (strlen($_GET['hash']) != 40)
+if (strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40)
 {
 	header("index.php"); 	
   	exit();

--- a/index.php
+++ b/index.php
@@ -133,14 +133,14 @@
 	<?php
 	//Cleanup page number to prevent XSS
 	if (isset($_GET["page_number"])) {
-		$_GET["page_number"] = htmlspecialchars($_GET["page_number"]);
+		$_GET["page_number"] = htmlentities($_GET["page_number"], ENT_QUOTES);
 	} else {
 		$_GET["page_number"] = "";
 	}
 	$scriptname = htmlspecialchars($scriptname);
 	
 	if (!isset($_GET["activeonly"]))
-		$scriptname = $scriptname . "activeonly=	yes&amp;";
+		$scriptname = $scriptname . "activeonly=yes&amp;";
 	if (isset($_GET["seededonly"]) && !isset($_GET["activeonly"]))
 	{
 		$scriptname = $scriptname . "seededonly=yes&";