From e0c5c4ee1e21dbfd0c1423878e7384a28e07fbef Mon Sep 17 00:00:00 2001
From: Bryan Crowe <bryan@bryan-crowe.com>
Date: Sun, 27 Jul 2014 23:07:31 -0400
Subject: [PATCH] Escape error template message output

---
 tests/test_app/TestApp/Template/Error/error400.ctp | 2 +-
 tests/test_app/TestApp/Template/Error/error500.ctp | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/test_app/TestApp/Template/Error/error400.ctp b/tests/test_app/TestApp/Template/Error/error400.ctp
index 8623e63e910..c2dc3326112 100644
--- a/tests/test_app/TestApp/Template/Error/error400.ctp
+++ b/tests/test_app/TestApp/Template/Error/error400.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= sprintf(
diff --git a/tests/test_app/TestApp/Template/Error/error500.ctp b/tests/test_app/TestApp/Template/Error/error500.ctp
index 535cb03c22c..b3c01e1d1a6 100644
--- a/tests/test_app/TestApp/Template/Error/error500.ctp
+++ b/tests/test_app/TestApp/Template/Error/error500.ctp
@@ -14,7 +14,7 @@
  */
 use Cake\Core\Configure;
 ?>
-<h2><?= $message; ?></h2>
+<h2><?= h($message) ?></h2>
 <p class="error">
 	<strong><?= __d('cake', 'Error'); ?>: </strong>
 	<?= __d('cake', 'An Internal Error Has Occurred.'); ?>