zhhealthcare/openemr — comment on commit f5ca77309034ab73b18c276bc67bcc70bdd1af79
File: interface/forms_admin/addlistPopup.php line 105
By bradymiller:

html escape $specialty_id and $specialy_name in the acho statements above:
either via the htmlspecialchars functions or the shortcut functions (attr() and text) in the library/htmlspecialchars.inc.php file)