Escape values to input fields (and some 'title' and 'alt')

[friendica.git] / view / templates / album_edit.tpl

diff --git a/view/templates/album_edit.tpl b/view/templates/album_edit.tpl
index 72aedd8b70aa02afc9a0f5e588a6eaa1401ea2e8..3d1d7573d7d51c1a289be4eb463ff3ca32debb7d 100644 (file)
--- a/view/templates/album_edit.tpl
+++ b/view/templates/album_edit.tpl
@@ -4,12 +4,12 @@
 
 
 <label id="photo-album-edit-name-label" for="photo-album-edit-name" >{{$nametext}}</label>
-<input type="text" size="64" name="albumname" value="{{$album}}" >
+<input type="text" size="64" name="albumname" value="{{$album|escape:'html'}}" >
 
 <div id="photo-album-edit-name-end"></div>
 
-<input id="photo-album-edit-submit" type="submit" name="submit" value="{{$submit}}" />
-<input id="photo-album-edit-drop" type="submit" name="dropalbum" value="{{$dropsubmit}}" onclick="return confirmDelete();" />
+<input id="photo-album-edit-submit" type="submit" name="submit" value="{{$submit|escape:'html'}}" />
+<input id="photo-album-edit-drop" type="submit" name="dropalbum" value="{{$dropsubmit|escape:'html'}}" onclick="return confirmDelete();" />
 
 </form>
 </div>