Escape values to input fields (and some 'title' and 'alt')

[friendica.git] / view / templates / install_db.tpl

diff --git a/view/templates/install_db.tpl b/view/templates/install_db.tpl
index b6bad0a2eeba35a14b0e0507af63661689ccf82d..f66bf119e88bbf8f6a959ad3ddd723189795e31c 100644 (file)
--- a/view/templates/install_db.tpl
+++ b/view/templates/install_db.tpl
@@ -16,7 +16,7 @@
 
 <form id="install-form" action="{{$baseurl}}/install" method="post">
 
-<input type="hidden" name="phpath" value="{{$phpath}}" />
+<input type="hidden" name="phpath" value="{{$phpath|escape:'html'}}" />
 <input type="hidden" name="pass" value="3" />
 
 {{include file="field_input.tpl" field=$dbhost}}
@@ -25,7 +25,7 @@
 {{include file="field_input.tpl" field=$dbdata}}
 
 
-<input id="install-submit" type="submit" name="submit" value="{{$submit}}" /> 
+<input id="install-submit" type="submit" name="submit" value="{{$submit|escape:'html'}}" /> 
 
 </form>