Escape values to input fields (and some 'title' and 'alt')

[friendica.git] / view / templates / login.tpl

diff --git a/view/templates/login.tpl b/view/templates/login.tpl
index 57c735d8f9eb47a833bc1773b3aa2527105911c9..37d105c087b0c53367ee7dd6d3d81970c9dc3201 100644 (file)
--- a/view/templates/login.tpl
+++ b/view/templates/login.tpl
@@ -17,16 +17,16 @@
        {{include file="field_checkbox.tpl" field=$lremember}}
 
        <div id="login-extra-links">
-               {{if $register}}<a href="register" title="{{$register.title}}" id="register-link">{{$register.desc}}</a>{{/if}}
-        <a href="lostpass" title="{{$lostpass}}" id="lost-password-link" >{{$lostlink}}</a>
+               {{if $register}}<a href="register" title="{{$register.title|escape:'html'}}" id="register-link">{{$register.desc}}</a>{{/if}}
+        <a href="lostpass" title="{{$lostpass|escape:'html'}}" id="lost-password-link" >{{$lostlink}}</a>
        </div>
        
        <div id="login-submit-wrapper" >
-               <input type="submit" name="submit" id="login-submit-button" value="{{$login}}" />
+               <input type="submit" name="submit" id="login-submit-button" value="{{$login|escape:'html'}}" />
        </div>
        
        {{foreach $hiddens as $k=>$v}}
-               <input type="hidden" name="{{$k}}" value="{{$v}}" />
+               <input type="hidden" name="{{$k}}" value="{{$v|escape:'html'}}" />
        {{/foreach}}