Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

/inc/getChat.php ---------------- 30: // New Chat text 31: if (isset($_POST['message']) && $_POST['message'] != '') { 32: $sql = "INSERT INTO fcms_chat_messages(chat_id, user_id, user_name, message, post_time) 33: VALUES (1, " . cleanInput($_POST['user_id']) . ", '" . cleanInput($_POST['name']) . "', '" . cleanInput($_POST['message']) . "', NOW())"; ... 46: //Create the XML response. 47: $xml = '<?xml version="1.0" ?><root>'; 48: // Get Users Online 49: if (isset($_GET['users'])) 50: // Timezone stuff 51: $sql = "SELECT `timezone` FROM `fcms_user_settings` WHERE `user` = ".cleanInput($_GET['user_id']); ... 107: $xml .= '<text>' . htmlspecialchars($message_array['message']) . '</text>';