From 4f79d51f2ea0fe9324499106ab39930e8ee91ad0 Mon Sep 17 00:00:00 2001
From: Thibault Le Meur <lemeur@users.sourceforge.net>
Date: Mon, 12 Mar 2007 14:01:56 +0000
Subject: [PATCH] Fixed bug #703, labels can now contain html code with single
 or double quotes to link images

git-svn-id: file:///Users/Shitiz/Downloads/lssvn/source/phpsurveyor@2565 b72ed6b6-b9f8-46b5-92b4-906544132732
---
 admin/labels.php | 2 +-
 qanda.php        | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/admin/labels.php b/admin/labels.php
index e88ae2aab9d..cce3ccae2be 100644
--- a/admin/labels.php
+++ b/admin/labels.php
@@ -322,7 +322,7 @@
     			
     			$labelsoutput.= "\t</td>\n"
     			."\t<td width='35%'>\n"
-    			."\t<input type='text' name='title_{$row['language']}_{$row['sortorder']}' maxlength='100' size='80' value=\"{$row['title']}\" />\n"
+    			."\t<input type='text' name='title_{$row['language']}_{$row['sortorder']}' maxlength='100' size='80' value=\"".html_escape($row['title'])."\" />\n"
     			."\t</td>\n"
     			."\t<td width='25%'>\n";
     			if ($activeuse == 0)
diff --git a/qanda.php b/qanda.php
index dd0b93b8942..791c0809066 100644
--- a/qanda.php
+++ b/qanda.php
@@ -2437,7 +2437,7 @@ function do_array_flexible($ia)
 			{
 				$answer .= "\t\t\t\t\t<td align='center' width='$cellwidth%'><label for='answer$myfname-$ld'>";
 				$answer .= "<input class='radio' type='radio' name='$myfname' value='$ld' id='answer$myfname-$ld' title='"
-				. $labelans[$thiskey]."'";
+				. html_escape($labelans[$thiskey])."'";
 				if (isset($_SESSION[$myfname]) && $_SESSION[$myfname] == $ld) {$answer .= " checked";}
 				// --> START NEW FEATURE - SAVE
 				$answer .= " onClick='checkconditions(this.value, this.name, this.type)' onChange='modfield(this.name)' /></label></td>\n";
@@ -2538,7 +2538,7 @@ function do_array_flexiblecolumns($ia)
 			$answer .= "\t\t\t\t\t<td align='center' class='$trbc' width='$cellwidth%'>"
 			. "<label for='answer$myfname-".$ansrow['code']."'>";
 			$answer .= "<input class='radio' type='radio' name='$myfname' value='".$ansrow['code']."' id='answer$myfname-".$ansrow['code']."'"
-			. " title='".$ansrow['answer']."'";
+			. " title='".html_escape($ansrow['answer'])."'";
 			if (isset($_SESSION[$myfname]) && $_SESSION[$myfname] == $ansrow['code']) {$answer .= " checked";}
 			// --> START NEW FEATURE - SAVE
 			$answer .= " onClick='checkconditions(this.value, this.name, this.type)' onChange='modfield(this.name)' /></label></td>\n";