LimeSurvey/LimeSurvey — pull request #164 by mfairchild365 (2014-01-03 19:47:30+00:00)
Title: Escape user input in json

This prevents broken json objects from being saved to the database.

The upload process saves the json object as a value of a hidden input in the HTML markup of the page. When a user has a single quote in the title, filename, or comment, the resulting value can create invalid markup.

Take this for example:
```

```
Here, you can see that the `title` in the json object contains a single quote, which closes the value attribute of the input early.

Because of this, when the form is submitted, only ``[{ "title":"test's`` is saved to the database, resulting in corrupted data.