diff --git a/src/Template/Error/duplicate_named_route.ctp b/src/Template/Error/duplicate_named_route.ctp
index 236fdb13fc8..d88d5f82864 100644
--- a/src/Template/Error/duplicate_named_route.ctp
+++ b/src/Template/Error/duplicate_named_route.ctp
@@ -25,7 +25,7 @@ $attributes = $error->getAttributes();
$this->start('subheading');
?>
Error:
- = $error->getMessage(); ?>
+ = h($error->getMessage()); ?>
end() ?>
start('file') ?>
@@ -50,9 +50,9 @@ Remove duplicate route names in your route configuration.
echo '';
printf(
'%s | %s | %s | ',
- $other->template,
- Debugger::exportVar($other->defaults),
- Debugger::exportVar($other->options)
+ h($other->template),
+ h(Debugger::exportVar($other->defaults)),
+ h(Debugger::exportVar($other->options))
);
echo '
';
?>
diff --git a/src/Template/Error/missing_route.ctp b/src/Template/Error/missing_route.ctp
index 9f53979c806..4a248c93e69 100644
--- a/src/Template/Error/missing_route.ctp
+++ b/src/Template/Error/missing_route.ctp
@@ -26,7 +26,7 @@ $attributes = $error->getAttributes();
$this->start('subheading');
?>
Error:
- = $error->getMessage(); ?>
+ = h($error->getMessage()); ?>
end() ?>
start('file') ?>
@@ -36,7 +36,7 @@ Add a matching route to = 'config' . DIRECTORY_SEPARATOR . 'routes.php' ?>
The passed context was:
-= Debugger::exportVar($attributes['context']); ?>
+= h(Debugger::exportVar($attributes['context'])); ?>
@@ -48,9 +48,9 @@ foreach (Router::routes() as $route):
echo '';
printf(
'%s | %s | %s | ',
- $route->template,
- Debugger::exportVar($route->defaults),
- Debugger::exportVar($route->options)
+ h($route->template),
+ h(Debugger::exportVar($route->defaults)),
+ h(Debugger::exportVar($route->options))
);
echo '
';
endforeach;