Fix reflected XSS in table/field drop panels

[Copilot]

Reflected XSS vulnerability in panels/tb_dropfields.php and panels/tb_droptables.php where $_POST['drop_cols'] and $_POST['drop_tables'] were output directly into HTML without sanitization.

Changes

• Sanitize all POST parameter outputs with htmlspecialchars($var, ENT_QUOTES, 'UTF-8')
• Apply to hidden input values, form field values, and inline displays
• Cover both table and field drop confirmation panels

Example

Before:

<input type="hidden" name="tb_table_name" value="<?php echo $_POST['drop_cols'];?>">

After:

<input type="hidden" name="tb_table_name" value="<?php echo htmlspecialchars($_POST['drop_cols'], ENT_QUOTES, 'UTF-8');?>">

Attackers could inject JavaScript via malicious POST data like "><script>alert(document.cookie)</script> to steal session tokens or perform actions on behalf of authenticated users.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[security vulnerability] Cross-Site Scripting (XSS) vulnerabilities</issue_title>
<issue_description>Recently, our team found a reflected cross-site scripting (XSS) vulnerability
The vulnerability logic is present in the file:
https://github.com/mariuz/firebirdwebadmin/blob/master/panels/tb_dropfields.php#L27

The echo directly outputs the parameter $_POST['drop_cols'] without any sanitization. This makes it susceptible to Cross-Site Scripting (XSS) attacks. As a result, attackers can exploit this vulnerability by injecting malicious html code with $_POST['drop_cols']

To fix this vulnerability, we recommend that developers implement properly sanitize (e.g., htmlspecialchars()) for user input before displaying it on the webpage.</issue_description>

<agent_instructions>Fix xss by properly sanitize (e.g., htmlspecialchars()) for user input before displaying it on the webpage.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [security vulnerability] Cross-Site Scripting (XSS) vulnerabilities #36

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.