bdenckla/vsource — Issue #13: ensure data from forms and db is valid HTML
Author: bdenckla
Created: 2011-11-04 17:45:30+00:00
State: open

I.e. use htmlspecialchars to escape stuff that would create invalid HTML when inserted into HTML, e.g.

Please select an incentive task value for ".$row['firstName']." ".$row['lastName'].":

could result in invalid HTML, or, perhaps worse, valid but unintended HTML, e.g. HTML-script injection attack!