Prevent possible XSS

[okhayat]

URL Encode value since it's used in URL

[Remo]

@okhayat Any reason not to use Loader::helper('text')->sanitize(..)? From what I've read it's not recommended to use urlencode to protect against XSS

[okhayat]

Not really. I just thought it would be ok. If it's better, I'll just update the code.

thanks,

[Remo]

not sure myself!

[Remo]

this recommends htmlspecialchars http://stackoverflow.com/a/5037413/5027773 sanitize only calls strip_tags, I don't think that's good enough either!

[Remo]

I think h(..) should be good: https://github.com/concrete5/concrete5-legacy/pull/1801/files https://github.com/concrete5/concrete5-legacy/pull/1101/files

[okhayat]

Updated. Thanks for the recommendation. Hope this helps.

[Remo]

thanks