bradymiller/openemr — comment on commit f9dc3687ea95ad70b4feb4eabaf0c7826d9a11ff
File: interface/main/calendar/dated_reminders.php line 137
By bradymiller:

Nice to see using htmlspecialchars to escape html. Note need ENT_QUOTES flag on most of these and note there are shortcut functions in library/htmlspecialchars.inc.php. The two functions are text(escape normal text) and attr(escape text within html attributes). For example:
```$mID = attr($r['messageID']);```
```$patientName = text($r['PatientName'])); ```

It would probably be clearer to not even create these variables and instead place directly into the string below. This avoids others using these variables within the algorithm below (using escaped variables within coding algorithm can cause buggy behavior).

For better explanation of the security model and using these functions see here:
http://www.open-emr.org/wiki/index.php/Codebase_Security#Plan