phpMyFAQ

Well, I took a look at the CVS snapshot. That's fine so far, but I think you must ensure that every reading access on $PMF_CONF[] values (if necessary) is enclosed in a htmlspecialchars() call.

Another approach could be the following: Use a better (you own) htmlspecialchars() implementation in the ...

Great reponse time!

Thanks a lot!

I'm using an ampersand in my FAQ title.
I think the values (e.g. $PMF_CONF["title"]) of the config.php should only be converted on reading and not on saving.

The function htmlspecialchars() is used in config.save.php to convert special characters to HTML entities. This function is also called in rss.php and the config values will be converted again.
Due to this I get an "&" for a simple "&" ("&" -> "&" -> &") in the RSS feed.

The "Target of the link" choice offers only the options "Link opens new window" and "Link within the FAQ".
I would like to have the option "Link opens in parent window" because I'm using phpMyFAQ in an inline frame and some links are refering to the parent frame.