From eecd327e42c3a92242b2f85856e5455920e65b8e Mon Sep 17 00:00:00 2001
From: Carsten Schmitz <c_schmitz@users.sourceforge.net>
Date: Wed, 19 Aug 2009 10:32:45 +0000
Subject: [PATCH] Fixed issue #3460: Apostrophes in additional attributes of
 token table errors on edit

git-svn-id: file:///Users/Shitiz/Downloads/lssvn/source/limesurvey@7490 b72ed6b6-b9f8-46b5-92b4-906544132732
---
 admin/tokens.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin/tokens.php b/admin/tokens.php
index fcd93f07a90..bcc231bdcbf 100644
--- a/admin/tokens.php
+++ b/admin/tokens.php
@@ -1707,7 +1707,7 @@
     foreach ($tokenfields as $tokenfield=>$tokendescription)
     {
             $nrofattributes++;
-            $tokenoutput.="<tr><td>$tokenfield</td><td><input type='text' name='description_$tokenfield' value='".htmlspecialchars($tokendescription)."' /></td><td>";
+            $tokenoutput.="<tr><td>$tokenfield</td><td><input type='text' name='description_$tokenfield' value='".htmlspecialchars($tokendescription,ENT_QUOTES,'UTF-8')."' /></td><td>";
             if ($examplerow!==false)
             {
                 $tokenoutput.=htmlspecialchars($examplerow[$tokenfield]);
@@ -1928,7 +1928,7 @@
         $tokenoutput .= "\t\t<tr>"
         ."<td align='right' width='20%'><strong>".$attr_description.":</strong></td>\n"
         ."\t<td><input type='text' size='55' name='$attr_name' value='";
-        if (isset($$attr_name)) { $tokenoutput .=$$attr_name;}
+        if (isset($$attr_name)) { $tokenoutput .=htmlspecialchars($$attr_name,ENT_QUOTES,'UTF-8');}
         $tokenoutput.="'></td>"
         ."</tr>";
 	}