bradymiller/openemr — comment on commit f9dc3687ea95ad70b4feb4eabaf0c7826d9a11ff
File: interface/main/calendar/dated_reminders_add.php line 125
By bradymiller:

Need to be escaped via php htmlspecialchars function. We have shortcut functions for this (that combine the xl function and the htmlspecialchars function at library/htmlspecialchars.inc.php). The two function are xlt(translate and escape normal text) and xla(translate and escape text within html attributes). So, all this items should be changed to xlt(), for example:
```$output .= '

* '.xlt('Please select a valid recipient').'

';```

For better explanation of the security model and using these functions see here:
http://www.open-emr.org/wiki/index.php/Codebase_Security#Plan