alsearch.php: Escape output of user provided parameters

Fixes the rest of #1478
jpatokal · Aug 20, 2024 · e7f5d81 · e7f5d81
1 parent d815df7
commit e7f5d81
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/php/alsearch.php b/php/alsearch.php
@@ -52,7 +52,7 @@
             sprintf(
                 _("A %s using the name or alias %s exists already."),
                 MODES_OPERATOR[$mode],
-                $name
+                htmlspecialchars($name)
             ));
         exit;
     }
@@ -77,7 +77,7 @@
                 sprintf(
                     _("A %s using the name or alias %s exists already."),
                     MODES_OPERATOR[$mode],
-                    $alias
+                    htmlspecialchars($alias)
                 ));
             exit;
         }