From 558959d4d7dcceff000fd5861f2f46451ebbd8a9 Mon Sep 17 00:00:00 2001
From: "David T. Sadler" <davidtsadler@googlemail.com>
Date: Mon, 1 Nov 2021 21:24:31 +0000
Subject: Ensure html is escaped

---
 src/templates/form_fields.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/templates/form_fields.php')

diff --git a/src/templates/form_fields.php b/src/templates/form_fields.php
index cfacfda..3f54040 100644
--- a/src/templates/form_fields.php
+++ b/src/templates/form_fields.php
@@ -1,12 +1,12 @@
-<input type="text" name="url" maxlength="512" value="<?php echo $old->get('url', $bookmark->url); ?>" autofocus><br>
+<input type="text" name="url" maxlength="512" value="<?php echo htmlspecialchars($old->get('url', $bookmark->url)); ?>" autofocus><br>
 <?php if ($errors->has('url')) { ?>
     <p><?php echo implode(', ', $errors->get('url')); ?></p>
 <?php } ?>
-<input type="text" name="title" maxlength="256" value="<?php echo $old->get('title', $bookmark->title); ?>"><br>
+<input type="text" name="title" maxlength="256" value="<?php echo htmlspecialchars($old->get('title', $bookmark->title)); ?>"><br>
 <?php if ($errors->has('title')) { ?>
     <p><?php echo implode(', ', $errors->get('title')); ?></p>
 <?php } ?>
-<input type="text" name="tag" maxlength="8" value="<?php echo $old->get('tag', $bookmark->tag); ?>"><br>
+<input type="text" name="tag" maxlength="8" value="<?php echo htmlspecialchars($old->get('tag', $bookmark->tag)); ?>"><br>
 <?php if ($errors->has('tag')) { ?>
     <p><?php echo implode(', ', $errors->get('tag')); ?></p>
 <?php } ?>
-- 
cgit v1.2.3-13-gbd6f