From 8276e36bced4d6ea99b6aaea29f59b0252cd15f7 Mon Sep 17 00:00:00 2001
From: marcus <marcus@36083f99-b078-4883-b0ff-0f9b5a30f544>
Date: Mon, 6 Jul 2009 16:52:10 +0000
Subject: Closes #1105: Value on input/pulldown view now escaped.

git-svn-id: https://code.elgg.org/elgg/trunk@3394 36083f99-b078-4883-b0ff-0f9b5a30f544
---
 views/default/input/pulldown.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'views/default')

diff --git a/views/default/input/pulldown.php b/views/default/input/pulldown.php
index fb7619048..fe53865f8 100644
--- a/views/default/input/pulldown.php
+++ b/views/default/input/pulldown.php
@@ -32,9 +32,9 @@
 	{
 		foreach($vars['options_values'] as $value => $option) {
 	        if ($value != $vars['value']) {
-	            echo "<option value=\"$value\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
+	            echo "<option value=\"".htmlentities($value, ENT_QUOTES, 'UTF-8')."\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
 	        } else {
-	            echo "<option value=\"$value\" selected=\"selected\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
+	            echo "<option value=\"".htmlentities($value, ENT_QUOTES, 'UTF-8')."\" selected=\"selected\">". htmlentities($option, ENT_QUOTES, 'UTF-8') ."</option>";
 	        }
 	    }
 	}
-- 
cgit v1.2.3