Patch: Bug/Hole in ONW Simple Contact Form

Hi,

Found a bug. When you submit a form with one of the variables in some way wrong, all the users input vanishes. This is really annoying. I found code that tried to fix this, but the code has bugs.

Worse, if the code was working there is an HTML-injection attack possible, because the input was not filtered before being passed back to the user.

The patch is http://jarofgreen.co.uk/wp-content/uploads/2011/03/patch.keepinput.txt

Note I used htmlspecialchars – I would prefer to use htmlentities with an UTF-8 charset, but I’m not certain what WordPress’s position on UTF-8 is.

Anyway, there you go.
James

http://wordpress.org/extend/plugins/onw-simple-contact-form/