| Index: trunk/extensions/inputbox/inputbox.php |
| — | — | @@ -159,6 +159,10 @@ |
| 160 | 160 | $this->buttonlabel = wfMsgHtml( 'tryexact' ); |
| 161 | 161 | } |
| 162 | 162 | |
| | 163 | + $buttonlabel = htmlspecialchars( $this->buttonlabel ); |
| | 164 | + $searchbuttonlabel = htmlspecialchars( $this->searchbuttonlabel ); |
| | 165 | + $id = Sanitizer::escapeId( $this->id ); |
| | 166 | + |
| 163 | 167 | $label = ''; |
| 164 | 168 | $styles = ''; |
| 165 | 169 | |
| — | — | @@ -185,7 +189,7 @@ |
| 186 | 190 | |
| 187 | 191 | $type = $this->hidden ? 'hidden' : 'text'; |
| 188 | 192 | $searchform=<<<ENDFORM |
| 189 | | -<form action="$search" class="bodySearch" {$styles} id="bodySearch{$id}"><div class="bodySearchWrap" style="{$styles}">{$label}<input type="{$type}" name="search" size="{$this->width}" class="bodySearchIput" id="bodySearchIput{$id}" /><input type="submit" name="go" value="{$buttonlabel}" class="bodySearchBtnGo" /> |
| | 193 | +<form action="$search" class="bodySearch" {$styles} id="bodySearch{$id}"><div class="bodySearchWrap" {$styles}>{$label}<input type="{$type}" name="search" size="{$this->width}" class="bodySearchIput" id="bodySearchIput{$id}" /><input type="submit" name="go" value="{$buttonlabel}" class="bodySearchBtnGo" /> |
| 190 | 194 | ENDFORM; |
| 191 | 195 | |
| 192 | 196 | if ( !empty( $this->fulltextbtn ) ) // this is wrong... |