mcrider/pkp-lib — comment on commit 3705e91a22d76d929efdc94fde0391bdd55cecb5
File:  line 0
By asmecher:

Matt, I think you'll have to wrap htmlentities(...) around *anything* in the view that displays a variable. As far as I can see there's no protection at all as it's currently written.