Escape values to input fields (and some 'title' and 'alt')

[friendica.git] / view / templates / directory_header.tpl

diff --git a/view/templates/directory_header.tpl b/view/templates/directory_header.tpl
index 29393aeda3d554552aa4336b4961eaef4f1bf9a7..2274f2e1f8ecd0ed71389466c2c9488dd51912c8 100644 (file)
--- a/view/templates/directory_header.tpl
+++ b/view/templates/directory_header.tpl
@@ -9,8 +9,8 @@
 <div id="directory-search-wrapper">
 <form id="directory-search-form" action="directory" method="get" >
 <span class="dirsearch-desc">{{$desc}}</span>
-<input type="text" name="search" id="directory-search" class="search-input" onfocus="this.select();" value="{{$search}}" />
-<input type="submit" name="submit" id="directory-search-submit" value="{{$submit}}" class="button" />
+<input type="text" name="search" id="directory-search" class="search-input" onfocus="this.select();" value="{{$search|escape:'html'}}" />
+<input type="submit" name="submit" id="directory-search-submit" value="{{$submit|escape:'html'}}" class="button" />
 </form>
 </div>
 <div id="directory-search-end"></div>