Add filename and username banning, add more de-deprecation stuff to posting/post.go

pkg/gcsql/posts.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"html"
 	"html/template"
 	"time"
 
@@ -231,6 +232,18 @@ func (p *Post) GetUpload() (*Upload, error) {
 	return upload, err
 }
 
+// Sanitize escapes HTML strings in a post. This should be run immediately before
+// the post is inserted into the database
+func (p *Post) Sanitize() {
+	if !p.sanitized {
+		p.Name = html.EscapeString(p.Name)
+		p.Email = html.EscapeString(p.Email)
+		p.Subject = html.EscapeString(p.Subject)
+		p.Password = html.EscapeString(p.Password)
+		p.sanitized = true
+	}
+}
+
 // UnlinkUploads disassociates the post with any uploads in DBPREFIXfiles
 // that may have been uploaded with it, optionally leaving behind a "File Deleted"
 // frame where the thumbnail appeared