Escape values written to HTML attributes

benthemonkey · Feb 26, 2016 · 2eb019e · 2eb019e
1 parent b7c1c7e
commit 2eb019e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/spc-committee-headquarters.php b/spc-committee-headquarters.php
@@ -129,8 +129,8 @@ function getFullName($slivkans, $nu_email)
 					} elseif ($i == $rowcount - 1) {
 						echo '<td class="totals">';
 					} else {
-						echo '<td data-event="'.$points_table['events'][$i].'" data-contributions="'.$td['contributions'].'" ';
-						echo 'data-comments="'.$td['comments'].'" class="pts';
+						echo '<td data-event="'.htmlentities($points_table['events'][$i]).'" data-contributions="'.$td['contributions'].'" ';
+						echo 'data-comments="'.htmlentities($td['comments']).'" class="pts';
 
 						if ($td['filled_by']) {
 							echo ' blue';