fix: added missing conversion to HTML entities

thorsten · Feb 12, 2023 · 56295b5 · 56295b5
1 parent 671f95b
commit 56295b5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
@@ -17,6 +17,7 @@
 
 namespace phpMyFAQ\Helper;
 
+use phpMyFAQ\Strings;
 use phpMyFAQ\User;
 
 /**
@@ -58,7 +59,7 @@ public function getAllUserOptions(int $id = 1, bool $allowBlockedUsers = false):
                     '<option value="%d" %s>%s (%s)</option>',
                     $userId,
                     (($userId === $id) ? 'selected' : ''),
-                    $this->user->getUserData('display_name'),
+                    Strings::htmlentities($this->user->getUserData('display_name')),
                     $this->user->getLogin()
                 );
             }