From 4650ad7fbde189678d180b8f294af3591f50b829 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Mon, 29 Feb 2016 12:14:46 +1100
Subject: [PATCH] A better way of escaping

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
 templates/table/search/input_box.phtml | 12 ++++++------
 templates/table/search/rows_zoom.phtml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/templates/table/search/input_box.phtml b/templates/table/search/input_box.phtml
index e9e09b9914..e5bcba1d2c 100644
--- a/templates/table/search/input_box.phtml
+++ b/templates/table/search/input_box.phtml
@@ -20,7 +20,7 @@ if ($_foreigners
                <?php if (isset($criteriaValues[$column_index])
                    && is_string($criteriaValues[$column_index])
                ): ?>
-                   value="<?php echo $criteriaValues[$column_index]; ?>"
+                   value="<?php echo htmlspecialchars($criteriaValues[$column_index]); ?>"
                <?php endif; ?> />
         <a class="ajax browse_foreign"
            href="browse_foreigners.php<?php
@@ -93,13 +93,13 @@ if ($_foreigners
                 && is_array($criteriaValues[$column_index])
                 && in_array($value[$j], $criteriaValues[$column_index])
             ): ?>
-                <option value="<?php echo $value[$j]; ?>"
+                <option value="<?php echo htmlspecialchars($value[$j]); ?>"
                         selected>
-                    <?php echo $value[$j]; ?>
+                    <?php echo htmlspecialchars($value[$j]); ?>
                 </option>
             <?php else: ?>
-                <option value="<?php echo $value[$j]; ?>">
-                    <?php echo $value[$j]; ?>
+                <option value="<?php echo htmlspecialchars($value[$j]); ?>">
+                    <?php echo htmlspecialchars($value[$j]); ?>
                 </option>
             <?php endif; ?>
         <?php endfor; ?>
@@ -129,7 +129,7 @@ if ($_foreigners
            <?php if (isset($criteriaValues[$column_index])
                && is_string($criteriaValues[$column_index])
            ): ?>
-               value="<?php echo $criteriaValues[$column_index]; ?>"
+               value="<?php echo htmlspecialchars($criteriaValues[$column_index]); ?>"
            <?php endif; ?>/>
 
 <?php endif; ?>
\ No newline at end of file
diff --git a/templates/table/search/rows_zoom.phtml b/templates/table/search/rows_zoom.phtml
index 1964eefbd0..fb9d83dfb7 100644
--- a/templates/table/search/rows_zoom.phtml
+++ b/templates/table/search/rows_zoom.phtml
@@ -68,7 +68,7 @@ for ($i = 0; $i < 4; $i++): ?>
         </td>
         <!-- Inputbox for search criteria value -->
         <td>
-            <?php echo (isset($value[$i]) ? htmlspecialchars($value[$i]) : ''); ?>
+            <?php echo (isset($value[$i]) ? $value[$i] : ''); ?>
         </td>
     </tr>
     <!-- Displays hidden fields -->