--- init.php.orig	2012-11-16 14:02:47.737621181 -0100
+++ init.php	2012-11-16 14:03:49.680340099 -0100
@@ -67,11 +67,11 @@
     unset($url);
 }
 
-// Change project name to lower case
-if (isset($_GET['project'])) $_GET['project'] = strtolower($_GET['project']);
-if (isset($_POST['project'])) $_POST['project'] = strtolower($_POST['project']);
-if (isset($_GET['paste_project'])) $_GET['paste_project'] = strtolower($_GET['paste_project']);
-if (isset($_POST['paste_project'])) $_POST['paste_project'] = strtolower($_POST['paste_project']);
+// Change project name to lower case and escape it
+if (isset($_GET['project'])) $_GET['project'] = htmlspecialchars(strtolower($_GET['project']));
+if (isset($_POST['project'])) $_POST['project'] = htmlspecialchars(strtolower($_POST['project']));
+if (isset($_GET['paste_project'])) $_GET['paste_project'] = htmlspecialchars(strtolower($_GET['paste_project']));
+if (isset($_POST['paste_project'])) $_POST['paste_project'] = htmlspecialchars(strtolower($_POST['paste_project']));
 
 // Set up the db connection
 $db->connect();