| Index: trunk/extensions/SemanticForms/includes/SF_FormPrinter.inc |
| — | — | @@ -1180,7 +1180,8 @@ |
| 1181 | 1181 | //$free_text = Sanitizer::safeEncodeAttribute($free_text); |
| 1182 | 1182 | } |
| 1183 | 1183 | // now that we have it, substitute free text into the form and page |
| 1184 | | - $form_text = str_replace('!free_text!', $free_text, $form_text); |
| | 1184 | + $escaped_free_text = Sanitizer::safeEncodeAttribute( $free_text ); |
| | 1185 | + $form_text = str_replace('!free_text!', $escaped_free_text, $form_text); |
| 1185 | 1186 | $data_text = str_replace('!free_text!', $free_text, $data_text); |
| 1186 | 1187 | |
| 1187 | 1188 | // add a warning in, if we're editing an existing page and that page |