HML encode embedded JSON data

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-07-13 11:31:55 +02:00 · 2016-07-13 11:31:55 +02:00 · 0f87b73ae2
commit 0f87b73ae2
parent 04156efeb0
1 changed files with 1 additions and 1 deletions
--- a/libraries/TableSearch.class.php
+++ b/libraries/TableSearch.class.php
@ -1180,7 +1180,7 @@ EOT;
            $html_output .= '<center><a href="#" onclick="displayHelp();">'
                . __('How to use') . '</a></center>';
            $html_output .= '<div id="querydata" style="display:none">'
-                . json_encode($data) . '</div>';
+                . htmlspecialchars(json_encode($data)) . '</div>';
            $html_output .= '<div id="querychart"></div>';
            $html_output .= '<button class="button-reset">'
                . __('Reset zoom') . '</button>';