hitoshura25/cvefixes huggingface dataset:
CVE-2024-29188 (C++, published 2024-03-24T20:15Z)
Description: value: WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wixtoolset/wix3
Files changed:
src/DTF/Tools/SfxCA/SfxUtil.cpp
src/ext/ca/wixca/dll/RemoveFoldersEx.cpp
Commit message: Don't follow junctions when recursing directories.

When deleting directories recursively, an elevated custom action
following junctions in a user-writable location could recurse into
any directory, including some that you might not want to be deleted.
Therefore, avoid recursing into directories that are actually
junctions (aka "reparse points").

This applies to:

- The RemoveFoldersEx custom action (which doesn't actually do deletions
but would instruct elevated MSI to delete on your behalf).
- DTF's custom action runner.


Vulnerable code:
                        if (wcscmp(fd.cFileName, L".") != 0 && wcscmp(fd.cFileName, L"..") != 0)
        
    

Fixed code:
                        if (wcscmp(fd.cFileName, L".") != 0
                            && wcscmp(fd.cFileName, L"..") != 0
                            && ((fd.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0))
    // Do NOT follow junctions.
    DWORD dwAttributes = ::GetFileAttributesW(wzPath);
    if (dwAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
    {
        WcaLog(LOGMSG_STANDARD, "Path is a junction; skipping: %ls", wzPath);
        ExitFunction();
    }
CVE-2018-21234 (Java, published 2020-05-21T23:15Z)
Description: value: Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/oblac/jodd
Files changed:
CHANGELOG.md
jodd-json/src/main/java/jodd/json/JsonParser.java
jodd-json/src/main/java/jodd/json/JsonParserBase.java
jodd-json/src/main/java/jodd/json/MapToBean.java
jodd-json/src/test/java/jodd/json/JSONDeserializerTest.java
Commit message: Added `allowClass` (closes #628)


Vulnerable code:

Fixed code:
+ **json** - added `allowClass` for whitelisting class names.
import java.util.ArrayList;
	/**
	 * Adds a {@link jodd.util.Wildcard wildcard} pattern for white-listing classes.
	 * @see #setClassMetadataName(String)
	 */
	public JsonParser allowClass(final String classPattern) {
		if (super.classnameWhitelist == null) {
			super.classnameWhitelist = new ArrayList<>();
		}
		classnameWhitelist.add(classPattern);
		return this;
	}

	/**
	 * Removes the whitelist of allowed classes.
	 * @see #setClassMetadataName(String)
	 */
	public JsonParser allowAllClasses() {
		classnameWhitelist = null;
		return this;
	}
	protected List<String> classnameWhitelist;
import jodd.util.Wildcard;
			checkClassName(jsonParser.classnameWhitelist, className);

	private void checkClassName(final List<String> classnameWhitelist, final String className) {
		if (classnameWhitelist == null) {
			return;
		}
		classnameWhitelist.forEach(pattern -> {
			if (!Wildcard.equalsOrMatch(className, pattern)) {
				throw new JsonException("Class can't be loaded as it is not whitelisted: " + className);
			}
		});
	}

import static org.junit.jupiter.api.Assertions.assertThrows;
	@Test
	void testPointWithException() {
		JsonParser.Defaults.classMetadataName = "__class";
		JsonSerializer.Defaults.classMetadataName = "__class";

		JsonParsers.forEachParser(jsonParser -> {
			jsonParser.allowClass("notAllowed");
			final String json = new JsonSerializer().serialize(new Point2D.Float(1.0f, 2.0f));
			assertThrows(JsonException.class, () -> {
				jsonParser.parse(json);
			});
			jsonParser.allowAllClasses();
		});
	}

	@Test
	void testPointWithoutExceptionWhitelisted() {
		JsonParser.Defaults.classMetadataName = "__class";
		JsonSerializer.Defaults.classMetadataName = "__class";

		JsonParsers.forEachParser(jsonParser -> {
			jsonParser.allowClass("*.Point?D*");
			String json = new JsonSerializer().serialize(new Point2D.Float(1.0f, 2.0f));
			Point2D.Float point = jsonParser.parse(json);
			assertEquals(1.0f, point.x, DELTA);
			assertEquals(2.0f, point.y, DELTA);
			jsonParser.allowAllClasses();
		});
	}
CVE-2013-7294 (C, published 2014-01-16T05:05Z)
Description: value: The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libreswan/libreswan
Files changed:
programs/pluto/ikev2_parent.c
Commit message: SECURITY: Properly handle IKEv2 I1 notification packet without KE payload


Vulnerable code:

	passert(GLOBALS_ARE_RESET());
			char fromname[ADDRTOT_BUF];

			addrtot(&md->sender, 0, fromname, ADDRTOT_BUF);
			return v2N_INVALID_KE_PAYLOAD;

	passert(GLOBALS_ARE_RESET());

	passert(GLOBALS_ARE_RESET());
		reset_globals();

	passert(GLOBALS_ARE_RESET());

Fixed code:
		char fromname[ADDRTOT_BUF];
		addrtot(&md->sender, 0, fromname, ADDRTOT_BUF);

		if (!md->chain[ISAKMP_NEXT_v2KE]) {
			/* is this a notify? If so, log it */
			if(md->chain[ISAKMP_NEXT_v2N]) {
				libreswan_log("Received Notify(%d): %s",
					md->chain[ISAKMP_NEXT_v2N]->payload.v2n.isan_type,
					enum_name(&ikev2_notify_names,
						md->chain[ISAKMP_NEXT_v2N]->payload.v2n.isan_type));
			}
			libreswan_log(
				"rejecting I1 from %s:%u, no KE payload present",
				fromname, md->sender_port);
			return STF_FAIL + v2N_INVALID_KE_PAYLOAD;
		}
			return STF_FAIL + v2N_INVALID_KE_PAYLOAD;
		reset_globals(); /* XXX suspicious - why was this deemed neccessary? */
CVE-2016-5361 (C, published 2016-06-16T14:59Z)
Description: value: programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libreswan/libreswan
Files changed:
programs/pluto/ikev1.c
Commit message: IKEv1: packet retransmit fixes for Main/Aggr/Xauth modes

- Do not schedule retransmits for inI1outR1 packets (prevent DDOS)
- Do schedule retransmits for XAUTH packets


Vulnerable code:
	  EVENT_v1_RETRANSMIT, main_inI1_outR1 },
	  EVENT_v1_RETRANSMIT, aggr_inI1_outR1 },
	  EVENT_SA_REPLACE, xauth_inI0 },
	  EVENT_SA_REPLACE, xauth_inI1 },

Fixed code:
	  EVENT_NULL, main_inI1_outR1 },
	  EVENT_NULL, aggr_inI1_outR1 },
	  EVENT_v1_RETRANSMIT, xauth_inI0 },
	  EVENT_v1_RETRANSMIT, xauth_inI1 },
CVE-2020-1763 (C, published 2020-05-12T14:15Z)
Description: value: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libreswan/libreswan
Files changed:
programs/pluto/ikev1.c
Commit message: security: Fix for CVE-2020-1763

pluto will crash on a null pointer dereference when trying to log an error
for an IKEv1 packet containing bogus information and/or flags.

Signed-off-by: Paul Wouters <pwouters@redhat.com>


Vulnerable code:
						st->st_state->name);

Fixed code:
						finite_states[smc->state]->name);
CVE-2021-27582 (Java, published 2021-02-23T18:15Z)
Description: value: org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
Files changed:
openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
Commit message: Fix Spring Autobinding vulnerability

1. Make authorizationRequest no longer affected by http request parameters due to @ModelAttribute. See http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html


Vulnerable code:
	public String confimAccess(Map<String, Object> model, @ModelAttribute("authorizationRequest") AuthorizationRequest authRequest,
			Principal p) {

Fixed code:
	public String confirmAccess(Map<String, Object> model, Principal p) {
		AuthorizationRequest authRequest = (AuthorizationRequest) model.get("authorizationRequest");
CVE-2017-20155 (Unknown, published 2022-12-30T23:15Z)
Description: value: A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal Search. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is 855d9560d3782c105568eedf9b22a769fbf29cc0. It is recommended to upgrade the affected component. The identifier VDB-217069 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Sterc/Analytics-dashboard-widget
Files changed:
Commit message: Merge pull request #12 from gpsietzema/development

Fixed XSS vulnerability #11

Vulnerable code:

Fixed code:
CVE-2018-15580 (PHP, published 2019-04-26T20:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
CVE-2018-15581 (PHP, published 2019-04-26T20:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
CVE-2018-15582 (PHP, published 2019-04-26T20:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
CVE-2018-15583 (PHP, published 2019-03-25T21:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>