From 8d3ee4903ae4b2db8cf766c2c51e8e59ab1eac44 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Tue, 5 Dec 2017 13:44:05 +0900
Subject: [PATCH] =?UTF-8?q?=EC=98=81=EC=B9=B4=ED=8A=B8CSS=20=EC=B7=A8?=
 =?UTF-8?q?=EC=95=BD=EC=A0=90(17-880)=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/shop_admin/coupontarget.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/adm/shop_admin/coupontarget.php b/adm/shop_admin/coupontarget.php
index ea5936551..a9a023db2 100644
--- a/adm/shop_admin/coupontarget.php
+++ b/adm/shop_admin/coupontarget.php
@@ -4,7 +4,7 @@ include_once('./_common.php');
 
 auth_check($auth[$sub_menu], "w");
 
-$sch_target = substr($_GET['sch_target'], 0, 1);
+$sch_target = substr(preg_replace('/[^a-zA-Z0-9]/', '', strip_tags($_GET['sch_target'])), 0, 1);
 $sch_word   = clean_xss_tags($_GET['sch_word']);
 
 if($_GET['sch_target'] == 1) {
@@ -67,7 +67,7 @@ $qstr1 = 'sch_target='.$sch_target.'&amp;sch_word='.urlencode($sch_word);
     </div>
 
     <form name="ftarget" method="get">
-    <input type="hidden" name="sch_target" value="<?php echo $_GET['sch_target']; ?>">
+    <input type="hidden" name="sch_target" value="<?php echo preg_replace('/[^a-zA-Z0-9]/', '', strip_tags($_GET['sch_target'])); ?>">
 
     <div id="scp_list_find">
         <label for="sch_word"><?php echo $t_name; ?></label>