buttonmen-dev/buttonmen — pull request #326 by cgolubi1 (2013-12-24 02:39:12+00:00)
Title: initial implementation of in-game chat

This isn't what i was supposed to be doing this evening, but i miss having it too...
* Fixes #237
* Requires a database reload

Big caveat: i'm reasonably comfortable doing this for now because we're behind the firewall, but i'm not super comfortable with it from the standpoint of preventing malicious input. For now, i've probably come up with a mix of security and functionality that satisfies neither, but seems okay to me for now:
* I use PHP htmlspecialchars to escape HTML special characters --- by default, this escapes all HTML codes and double-quotes, but not single quotes. (But i verified that single-quotes i type seem to wind up harmlessly inside the database.)
* I don't do anything special about SQL attacks, but count on PDO::prepare() to Do The Right Thing. I can't immediately figure out whether or not that's good enough.