Bugfix: The contact names had to be escaped

[friendica.git] / mod / viewcontacts.php

diff --git a/mod/viewcontacts.php b/mod/viewcontacts.php
index 19bf0415c7f86b5daece0b5696250452ee24f8d1..a6bf74b2885df20042a8de26186029a12db00917 100644 (file)
--- a/mod/viewcontacts.php
+++ b/mod/viewcontacts.php
@@ -63,8 +63,8 @@ function viewcontacts_content(&$a) {
                        'id' => $rr['id'],
                        'img_hover' => sprintf( t('Visit %s\'s profile [%s]'), $rr['name'], $rr['url']),
                        'thumb' => proxy_url($rr['thumb'], false, PROXY_SIZE_THUMB),
-                       'name' => substr($rr['name'],0,20),
-                       'username' => $rr['name'],
+                       'name' => htmlentities(substr($rr['name'],0,20)),
+                       'username' => htmlentities($rr['name']),
                        'url' => $url,
                        'sparkle' => '',
                        'itemurl' => $rr['url'],