Index: captcha.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/captcha/captcha.module,v
retrieving revision 1.103.2.9
diff -u -r1.103.2.9 captcha.module
--- captcha.module	5 Jul 2010 21:37:21 -0000	1.103.2.9
+++ captcha.module	11 Oct 2010 12:56:22 -0000
@@ -480,9 +480,17 @@
       $post_data = array();
     }
     // Get the posted form_id and CAPTCHA session ID.
-    $posted_form_id = isset($post_data['form_id']) ? $post_data['form_id'] : NULL;
-    $posted_captcha_sid = isset($post_data['captcha_sid']) ? (int) $post_data['captcha_sid'] : NULL;
-    $posted_captcha_token = isset($post_data['captcha_token']) ? (string) $post_data['captcha_token'] : NULL;
+    // Because we possibly use raw post data here,
+    // we should be extra cautious and filter this data.
+    $posted_form_id = isset($post_data['form_id']) ?
+      preg_replace("/[^a-z0-9_]/", "", (string) $post_data['form_id'])
+      : NULL;
+    $posted_captcha_sid = isset($post_data['captcha_sid']) ?
+      (int) $post_data['captcha_sid']
+      : NULL;
+    $posted_captcha_token = isset($post_data['captcha_token']) ?
+      preg_replace("/[^a-zA-Z0-9]", "", (string) $post_data['captcha_token'])
+      : NULL;
 
     // Check if the posted CAPTCHA token is valid for the posted CAPTCHA
     // session ID. Note that we could just check the validity of the CAPTCHA