From fc976f2bedd6c7484844ab6de95236863b228496 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Fri, 5 Jan 2018 10:19:47 +0900
Subject: [PATCH] =?UTF-8?q?=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=84=A4?=
 =?UTF-8?q?=EB=AC=B8=EC=A1=B0=EC=82=AC=20=ED=8E=98=EC=9D=B4=EC=A7=80=20?=
 =?UTF-8?q?=ED=95=84=ED=84=B0=EA=B5=AC=EB=AC=B8=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 adm/poll_form_update.php | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/adm/poll_form_update.php b/adm/poll_form_update.php
index a3cba14ad..2d01fe6dd 100644
--- a/adm/poll_form_update.php
+++ b/adm/poll_form_update.php
@@ -10,6 +10,40 @@ auth_check($auth[$sub_menu], 'w');
 
 check_admin_token();
 
+$check_keys = array(
+'po_subject',
+'po_poll1',
+'po_poll2',
+'po_poll3',
+'po_poll4',
+'po_poll5',
+'po_poll6',
+'po_poll7',
+'po_poll8',
+'po_poll9',
+'po_cnt1',
+'po_cnt2',
+'po_cnt3',
+'po_cnt4',
+'po_cnt5',
+'po_cnt6',
+'po_cnt7',
+'po_cnt8',
+'po_cnt9',
+'po_etc',
+'po_level',
+'po_point',
+'po_id'
+);
+
+foreach( $_POST as $key=>$value ){
+    if( empty($value) ) continue;
+
+    if( in_array($key, $check_keys) ) {
+        $_POST[$key] = strip_tags($value);
+    }
+}
+
 if ($w == '')
 {
     $sql = " insert {$g5['poll_table']}