Online Subtitles Workshop XSS defect and repair

Title: Online Subtitles Workshop XSS vulnerabilities
Author: M. Jock3R (www. the-code.tk) www.2cto.com
: Http://sourceforge.net/projects/onlinesubtitles/files/
Test Platform: windows XP Sp2 FR
========================================================== ========================================================== ===
 
Defect location: video_comments.php
 
Code Analysis:
---------
$ All_comments = read_video_comments ($ video_id );
 
// Print_r ($ all_comments );
 
$ Video_comments = "";
 
For ($ I = 0; $ I <= count ($ all_comments)-1; $ I ++ ){
 
$ Video_comments = $ video_comments ."
<Table style = 'width: 100% '>
<Tr>
<Td style = 'width: 100% '>
". Get_user_name ($ all_comments [$ I] ['id'])."
</Td>
<Td>
 
". Date ('H: I: s A m-d-y', $ all_comments [$ I] ['time'])."
</Td>
</Tr>
<Tr>
<Td colspan = '7'>
". $ All_comments [$ I] ['message']." <= Here you can inject any HTML or Javascript code :)
</Td>
</Tr>
</Table>
<Br>
";
 
Example:
---------
Select any video first.
Comment, written as follows: <marquee> <font color = red size = 15> M. jock3r </font>/marquee>
-Or you can steal the cookies of any one browse the video page :)
 
========================================================== ========================================================== ===
Fix: Filter