fix: added missing conversion to HTML entities

thorsten · Feb 15, 2023 · 53134f5 · 53134f5
1 parent 0d3e2ad
commit 53134f5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/phpmyfaq/src/phpMyFAQ/Comments.php b/phpmyfaq/src/phpMyFAQ/Comments.php
@@ -159,7 +159,7 @@ private function showShortComment(int $id, string $comment): string
 
         $comment = '';
         foreach ($words as $word) {
-            $comment .= $word . ' ';
+            $comment .= Strings::htmlentities($word . ' ');
             if (15 === $numWords) {
                 $comment .= '<span class="comment-dots-' . $id . '">&hellip; </span>' .
                     '<a href="#" data-comment-id="' . $id . '" class="pmf-comments-show-more comment-show-more-' . $id .