From 2f4e9f3892d3bfabf059ecc7aff311e7fa2b76b9 Mon Sep 17 00:00:00 2001
From: Pk11 <epicpkmn11@outlook.com>
Date: Thu, 2 Jun 2022 07:35:01 -0500
Subject: [PATCH] Properly escape HTML

---
 video.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/video.php b/video.php
index 3baec96..f709b27 100644
--- a/video.php
+++ b/video.php
@@ -9,7 +9,7 @@
 	<meta property="og:url" content="https://home.pk11.us/video.php">
 	<meta property="title" content="Discord video embedder">
 	
-	<?php $video = str_replace(' ', '%20', $_GET['video']); ?>
+	<?php $video = htmlspecialchars(str_replace(' ', '%20', $_GET['video'])); ?>
 
 	<?php if($video) { ?>
 		<meta property="og:video" content="<?php echo $video ?>">
@@ -43,7 +43,7 @@
 <body>
 	<?php if($video) { ?>
 		<video controls autoplay>
-			<source src="<?php echo $video ?>" type="video/mp4">
+			<source src="<?php echo $video; ?>" type="video/mp4">
 		</video>
 	<?php } else { ?>
 		<p>Put ?video=[link to video] at the end of the URL and Discord will show an embed of that video.</p>
