Add missing escaping to partition listing

Signed-off-by: Michal Čihař <michal@cihar.com>
phpmyadmin · Jun 17, 2016 · 0815af3 · 0815af3
1 parent 418aeea
commit 0815af3
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/templates/table/structure/display_partitions.phtml b/templates/table/structure/display_partitions.phtml
@@ -10,12 +10,12 @@ use PMA\libraries\Util; ?>
         <?php else: ?>
             <p>
                 <?= __('Partitioned by:');?>
-                <code><?= $partitionMethod , '(' , $partitionExpression , ' )'; ?></code>
+                <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
             </p>
             <?php if ($hasSubPartitions): ?>
                 <p>
                     <?= __('Sub partitioned by:'); ?>
-                    <code><?= $subPartitionMethod , '(' , $subPartitionExpression , ' )'; ?></code>
+                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
                 <p>
             <?php endif; ?>
             <table>
@@ -139,4 +139,4 @@ use PMA\libraries\Util; ?>
             <?php endif; ?>
         </form>
     </fieldset>
-</div>
+</div>