tajemo/openemr — comment on commit c94930223aba7430a2f50d0122a257c79ba2b7a1
File: interface/main/calendar/dated_reminders_add.php line 19
By bradymiller:

// Include html escaping functions (to prevent cross-scripting attacks)
require_once("$srcdir/htmlspecialchars.inc.php");

See here for security model:
http://www.open-emr.org/wiki/index.php/Codebase_Security#Plan