Avoid double escaping in second page title

diff --git a/adminer/create.inc.php b/adminer/create.inc.php
index 93c415ad9b708136d4e0b3fbae1e9c9ed74b4216..1bb8715d172985b9927771be98e6bd80172c2314 100644 (file)
--- a/adminer/create.inc.php
+++ b/adminer/create.inc.php
@@ -108,7 +108,7 @@ if ($_POST && !process_fields($row["fields"]) && !$error) {
        }
 }
 
-page_header(($TABLE != "" ? lang('Alter table') : lang('Create table')), $error, array("table" => $TABLE), $TABLE);
+page_header(($TABLE != "" ? lang('Alter table') : lang('Create table')), $error, array("table" => $TABLE), h($TABLE));
 
 if (!$_POST) {
        $row = array(

diff --git a/adminer/database.inc.php b/adminer/database.inc.php
index caf315838a8e88b8c50363d9b73088dc76c02eb1..d2a5b6183311a32be213a391f5c1ebea8371ebe0 100644 (file)
--- a/adminer/database.inc.php
+++ b/adminer/database.inc.php
@@ -35,7 +35,7 @@ if ($_POST && !$error && !isset($_POST["add_x"])) { // add is an image and PHP c
        }
 }
 
-page_header(DB != "" ? lang('Alter database') : lang('Create database'), $error, array(), DB);
+page_header(DB != "" ? lang('Alter database') : lang('Create database'), $error, array(), h(DB));
 
 $collations = collations();
 $name = DB;

diff --git a/adminer/dump.inc.php b/adminer/dump.inc.php
index cb51f18157982175a86ddc0bf6baecbca4abdd85..4ad663a3e8f837ba4ed270a088a9748147dd151a 100644 (file)
--- a/adminer/dump.inc.php
+++ b/adminer/dump.inc.php
@@ -117,7 +117,7 @@ SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO';
        exit;
 }
 
-page_header(lang('Export'), $error, ($_GET["export"] != "" ? array("table" => $_GET["export"]) : array()), DB);
+page_header(lang('Export'), $error, ($_GET["export"] != "" ? array("table" => $_GET["export"]) : array()), h(DB));
 ?>
 
 <form action="" method="post">

diff --git a/adminer/edit.inc.php b/adminer/edit.inc.php
index 844e5354fd01e5137593c0f623389e3b14c5595e..d63e153457a6f4c7bdbe7bbf681c2660266b92fd 100644 (file)
--- a/adminer/edit.inc.php
+++ b/adminer/edit.inc.php
@@ -65,7 +65,7 @@ page_header(
        ($update ? lang('Edit') : lang('Insert')),
        $error,
        array("select" => array($TABLE, $table_name)),
-       $table_name //! two calls of h()
+       $table_name
 );
 
 $row = null;

diff --git a/adminer/foreign.inc.php b/adminer/foreign.inc.php
index 1768a1013c70dc35fc3cc7f48e3e6e0ec435705d..e9dc8babca3eafe4a0b71cc637644e4ab7223cef 100644 (file)
--- a/adminer/foreign.inc.php
+++ b/adminer/foreign.inc.php
@@ -24,7 +24,7 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["change"] && !$_POST["change-
        }
 }
 
-page_header(lang('Foreign key'), $error, array("table" => $TABLE), $TABLE);
+page_header(lang('Foreign key'), $error, array("table" => $TABLE), h($TABLE));
 
 if ($_POST) {
        ksort($row["source"]);

diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index 8771e17a0b8008cd619a5d275f7f81f976bb87fc..312fa1c5260a49cdf6f012ffc46fd484a9da3589 100644 (file)
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -2,14 +2,14 @@
 /** Print HTML header
 * @param string used in title, breadcrumb and heading, should be HTML escaped
 * @param string
-* @param mixed array("key" => "link=desc", "key2" => array("link", "desc")), null for nothing, false for driver only, true for driver and server
-* @param string used after colon in title and heading, will be HTML escaped
+* @param mixed array("key" => "link", "key2" => array("link", "desc")), null for nothing, false for driver only, true for driver and server
+* @param string used after colon in title and heading, should be HTML escaped
 * @return null
 */
 function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") {
        global $LANG, $adminer, $connection, $drivers;
        page_headers();
-       $title_all = $title . ($title2 != "" ? ": " . h($title2) : "");
+       $title_all = $title . ($title2 != "" ? ": $title2" : "");
        $title_page = strip_tags($title_all . (SERVER != "" && SERVER != "localhost" ? h(" - " . SERVER) : "") . " - " . $adminer->name());
        ?>
 <!DOCTYPE html>

diff --git a/adminer/indexes.inc.php b/adminer/indexes.inc.php
index e9ab675fc9f52acd8707bdd85c4d4f0f94461e4b..8ca12c617899cc7950dfbba4f5bd449b95e7c42b 100644 (file)
--- a/adminer/indexes.inc.php
+++ b/adminer/indexes.inc.php
@@ -64,7 +64,7 @@ if ($_POST && !$error && !$_POST["add"]) {
        queries_redirect(ME . "table=" . urlencode($TABLE), lang('Indexes have been altered.'), alter_indexes($TABLE, $alter));
 }
 
-page_header(lang('Indexes'), $error, array("table" => $TABLE), $TABLE);
+page_header(lang('Indexes'), $error, array("table" => $TABLE), h($TABLE));
 
 $fields = array_keys(fields($TABLE));
 if ($_POST["add"]) {

diff --git a/adminer/schema.inc.php b/adminer/schema.inc.php
index 6383c86d5bd7f348dc6a8be1cac4948539f5ac68..c49da5379af6dd9ee1020d0abb8765aac96bc88c 100644 (file)
--- a/adminer/schema.inc.php
+++ b/adminer/schema.inc.php
@@ -1,5 +1,5 @@
 <?php
-page_header(lang('Database schema'), "", array(), DB . ($_GET["ns"] ? ".$_GET[ns]" : ""));
+page_header(lang('Database schema'), "", array(), h(DB . ($_GET["ns"] ? ".$_GET[ns]" : "")));
 
 $table_pos = array();
 $table_pos_js = array();

diff --git a/adminer/view.inc.php b/adminer/view.inc.php
index c627b446315a23df38db5d28acf081688df8f8de..32578b58b1a8c45b56860ba6f9d767c56401e35c 100644 (file)
--- a/adminer/view.inc.php
+++ b/adminer/view.inc.php
@@ -36,7 +36,7 @@ if (!$_POST && $TABLE != "") {
        }
 }
 
-page_header(($TABLE != "" ? lang('Alter view') : lang('Create view')), $error, array("table" => $TABLE), $TABLE);
+page_header(($TABLE != "" ? lang('Alter view') : lang('Create view')), $error, array("table" => $TABLE), h($TABLE));
 ?>
 
 <form action="" method="post">