nokonoko/Pomf — pull request #9 by Zemnmez (2014-06-28 18:10:28+00:00)
Title: Fix XSS in /respond.php

Tripped over this one. By no means even slightly a complete pentest. Had a little look over your code, your url generating code is strange; URL shortening algorithms work by mapping large indexes to short strings, a more correct algorithm is to map your number onto a high base dictated by the set of acceptable characters. Here is an implementation in PHP:

```PHP
$ch) {
$o += strpos($d, $ch) * pow($dl, $pos);
}
return $o;
}

```
1538 → Mu
Mu → 1358