From 6ce761812eeb9c91da8165a9888abfd984505220 Mon Sep 17 00:00:00 2001
From: Ralf Becker <ralfbecker@outdoor-training.de>
Date: Sat, 14 Jun 2003 13:47:41 +0000
Subject: [PATCH] added some htmlspecialchars() to the values of input and
 textarea, to allow transparent use of " and '

---
 etemplate/inc/class.html.inc.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/etemplate/inc/class.html.inc.php b/etemplate/inc/class.html.inc.php
index f86c3be4f9..22be3eced0 100644
--- a/etemplate/inc/class.html.inc.php
+++ b/etemplate/inc/class.html.inc.php
@@ -63,7 +63,7 @@ class html
 		}
 		while (list($k,$text) = each($arr))
 		{
-			$out .= '<option value="'.$k.'"';
+			$out .= '<option value="'.htmlspecialchars($k).'"';
 			if("$k" == "$key" || strstr(",$key,",",$k,"))
 			{
 				$out .= " SELECTED";
@@ -99,14 +99,14 @@ class html
 
 	function textarea($name,$value='',$options='' )
 	{
-		return "<TEXTAREA name=\"$name\" $options>$value</TEXTAREA>\n";
+		return "<TEXTAREA name=\"$name\" $options>".htmlspecialchars($value)."</TEXTAREA>\n";
 	}
 
 	function input($name,$value='',$type='',$options='' )
 	{
 		if ($type) $type = 'TYPE="'.$type.'"';
 
-		return "<INPUT $type NAME=\"$name\" VALUE=\"$value\" $options>\n";
+		return "<INPUT $type NAME=\"$name\" VALUE=\"".htmlspecialchars($value)."\" $options>\n";
 	}
 
 	function submit_button($name,$lang,$onClick='',$no_lang=0,$options='',$image='',$app='')