bradymiller/openemr — comment on commit f9dc3687ea95ad70b4feb4eabaf0c7826d9a11ff
File: interface/main/calendar/dated_reminders.php line 158
By bradymiller:

Need to be escaped via php htmlspecialchars function. We have shortcut functions for this (that combine the xl function and the htmlspecialchars function at library/htmlspecialchars.inc.php). The two function are xlt(translate and escape normal text) and xla(translate and escape text within html attributes). For example:
```return ($pdHTML == '' ? '

'.xlt('No Messages').'

' : $pdHTML); ```

For better explanation of the security model and using these functions see here:
http://www.open-emr.org/wiki/index.php/Codebase_Security#Plan