bradymiller/openemr — comment on commit f9dc3687ea95ad70b4feb4eabaf0c7826d9a11ff
File: interface/main/calendar/dated_reminders_log.php line 66
By bradymiller:

These all need to be escaped by the php htmlspecialchars function. There are shortcut functions in library/htmlspecialchars.inc.php. The two functions are text(escape normal text) and attr(escape text within html attributes). So, all these items should be changed to text(), for example:
```	'.text($RA['messageID'].'```

For better explanation of the security model and using these functions see here:
http://www.open-emr.org/wiki/index.php/Codebase_Security#Plan