zhhealthcare/openemr — comment on commit f5ca77309034ab73b18c276bc67bcc70bdd1af79
File: interface/forms_admin/forms_admin.php line 224
By bradymiller:

html escape above variables the echo statements above:
either via the htmlspecialchars functions or the shortcut functions (attr() and text) in the library/htmlspecialchars.inc.php file)