ucla/mwf — comment on commit 8cdf3aed42665f4e6908448f18ee4ab68fa095b0
File: root/assets/lib/decorator/site/form.class.php line 337
By Trott:

All these htmlspecialchars() calls seem to be in the wrong place. Functions like add_label_tooltip() should expect to receive an id and a label, but the code here indicates that it expects to receive an HTML-escaped label. That's too tightly coupled. (For example, what if we want add an option so that add_label_tooltip() can render in a format other than HTML?)