trashmai / nomenmatch Goto Github PK

Hello. I would like to ask about the security matters of MyMatch.
As far as I checked, the program seems not to sanitize HTML tags, so I am afraid that there are security holes such as XSS. At least, when I input "Papilio <!--", the remaining table has been commented out. I think the system had better to sanitize any inputted strings, that is, replace meta characters in inputs to
character entity references.

Now we are preparing to build an instance of MyMatch service. The target people are not familiar to English (and also Chinese), we are trying to translate the interface into Japanese. We feel some difficulties for translation because many sentences such as error messages are embedded in the source code. So we are pleased if you try to move messages to a separate include file as constants, like:

before:
/include/queryNames.php
extract_results($query_url_1_err, "Type 1-e: Full match with minor err", $reset=false, $against);

after:
/include/error_messages.inc
define("ERR_TYPE1E", "Type 1-e: Full match with minor err");
/include/queryNames.php
extract_results($query_url_1_err, ERR_TYPE1E, $reset=false, $against);

We can check changes of message even if they are changed in future versions. So such improvements are useful for our translation. Also, these change is useful to construct instances in other languages. Thank you very much.