Add HTML escaping for good measure

meeting-room-booking-system · Sep 13, 2023 · ff88980 · ff88980
1 parent 27eb9b8
commit ff88980
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/web/admin.php b/web/admin.php
@@ -473,7 +473,7 @@ function generate_new_room_form()
                     echo "<td><div>" . htmlspecialchars($r[$field['name']] ?? '') . "</div></td>\n";
                     break;
                   case 'capacity':
-                    echo "<td class=\"int\"><div>" . $r[$field['name']] . "</div></td>\n";
+                    echo "<td class=\"int\"><div>" . htmlspecialchars($r[$field['name']] ?? '') . "</div></td>\n";
                     break;
                   case 'invalid_types':
                     echo "<td><div>" . get_type_names($r[$field['name']]) . "</div></td>\n";
@@ -491,7 +491,7 @@ function generate_new_room_form()
                     elseif (($field['nature'] == 'integer') && isset($field['length']) && ($field['length'] > 2))
                     {
                       // integer values
-                      echo "<td class=\"int\"><div>" . $r[$field['name']] . "</div></td>\n";
+                      echo "<td class=\"int\"><div>" . htmlspecialchars($r[$field['name']] ?? '') . "</div></td>\n";
                     }
                     else
                     {