From 558959d4d7dcceff000fd5861f2f46451ebbd8a9 Mon Sep 17 00:00:00 2001
From: "David T. Sadler" <davidtsadler@googlemail.com>
Date: Mon, 1 Nov 2021 21:24:31 +0000
Subject: Ensure html is escaped

---
 src/templates/confirm_deletion.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/templates/confirm_deletion.php')

diff --git a/src/templates/confirm_deletion.php b/src/templates/confirm_deletion.php
index 0a800e5..06e133f 100644
--- a/src/templates/confirm_deletion.php
+++ b/src/templates/confirm_deletion.php
@@ -9,7 +9,7 @@
         <a href="/">Back</a>
         <form action="/delete" method="POST">
             <input type="hidden" name="id" value="<?php echo $bookmark->id; ?>"/>
-            <?php echo $bookmark->url.' '.$bookmark->title.' '.$bookmark->tag; ?>
+            <?php echo htmlentities($bookmark->url.' '.$bookmark->title.' '.$bookmark->tag); ?>
             <button type="submit">Delete</button>
         </form>
     </body>
-- 
cgit v1.2.3-13-gbd6f