From: marcus <marcus@36083f99-b078-4883-b0ff-0f9b5a30f544>
Date: Mon, 6 Jul 2009 16:52:10 +0000 (+0000)
Subject: Closes #1105: Value on input/pulldown view now escaped.
X-Git-Url: https://gitweb.fluxo.info/?a=commitdiff_plain;h=8276e36bced4d6ea99b6aaea29f59b0252cd15f7;p=lorea%2Felgg.git

Closes #1105: Value on input/pulldown view now escaped.

git-svn-id: https://code.elgg.org/elgg/trunk@3394 36083f99-b078-4883-b0ff-0f9b5a30f544
---

diff --git a/views/default/input/pulldown.php b/views/default/input/pulldown.php
index fb7619048..fe53865f8 100644
--- a/views/default/input/pulldown.php
+++ b/views/default/input/pulldown.php
@@ -32,9 +32,9 @@
 	{
 		foreach($vars['options_values'] as $value => $option) {
 	        if ($value != $vars['value']) {
-	            echo "<option value=\"$value\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
+	            echo "<option value=\"".htmlentities($value, ENT_QUOTES, 'UTF-8')."\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
 	        } else {
-	            echo "<option value=\"$value\" selected=\"selected\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
+	            echo "<option value=\"".htmlentities($value, ENT_QUOTES, 'UTF-8')."\" selected=\"selected\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
 	        }
 	    }
 	}