convert $title and $th special characters to HTML

Seldaek · Nov 20, 2013 · e98c525 · e98c525
1 parent b230483
commit e98c525
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/Monolog/Formatter/HtmlEmailFormatter.php b/src/Monolog/Formatter/HtmlEmailFormatter.php
@@ -50,6 +50,7 @@ public function __construct($dateFormat = null)
      */
     private function addRow($th, $td = ' ')
     {
+        $th = htmlspecialchars($th);
         $td = '<pre>'.htmlspecialchars($td).'</pre>';
 
         return "<tr style=\"padding: 4px;spacing: 0;text-align: left;\">\n<th style=\"background: #cccccc\" width=\"100px\">$th:</th>\n<td style=\"padding: 4px;spacing: 0;text-align: left;background: #eeeeee\">".$td."</td>\n</tr>";
@@ -64,6 +65,8 @@ private function addRow($th, $td = ' ')
      */
     private function addTitle($title, $level)
     {
+        $title = htmlspecialchars($title);
+
         return '<h1 style="background: '.$this->logLevels[$level].';color: #ffffff;padding: 5px;">'.$title.'</h1>';
     }
     /**