Home » HTML » HTML_QuickForm » Bug #6566
option text is not html-encoded in HTML_QuickForm_select
Details
| Submitted | 2006-01-24 13:43 UTC |
|---|---|
| From | erik-pear at 29a dot nl |
| Status | Wont fix |
| Package | HTML_QuickForm |
| PHP Version | 5.0.5 |
| OS | Irrelevant |
| Roadmaps | (Not assigned) |
Comments
[2006-01-24 13:43 UTC] erik-pear at 29a dot nl
Description:
------------
The 'text' value for options is not converted with htmlentities(). This can cause problems if the text value contains characters like "<".
Test script:
---------------
<?php
require_once('HTML/QuickForm.php');
$form = new HTML_QuickForm();
$sel = $form->createElement('select', 'test');
$sel->addOption('foo<bar', 'foo');
$form->addElement($sel);
$form->display();
?>
Changing line 492 in HTML/QuickForm/select.php from
$option['text'] . "</option>\n";
to
htmlspecialchars($option['text']) . "</option>\n";
fixes the problem.
Expected result:
----------------
<option value="foo">foo<bar</option>
Actual result:
--------------
<option value="foo">foo<bar</option>