Escape var values in exception messages.

src/AbstractPaymentRequest.php

@@ -306,7 +306,7 @@ public function set_country_code( $country_code ) {
 			throw new InvalidArgumentException(
 				sprintf(
 					'Given country code `%s` not ISO 3166-1 alpha-2 value.',
-					$country_code
+					\esc_html( $country_code )
 				)
 			);
 		}

src/Address.php

@@ -82,7 +82,7 @@ public function __construct( $country, $street = null, $house_number_or_name = n
 			throw new InvalidArgumentException(
 				sprintf(
 					'Given country `%s` not ISO 3166-1 alpha-2 value.',
-					$country
+					\esc_html( $country )
 				)
 			);
 		}
@@ -124,8 +124,8 @@ public function __construct( $country, $street = null, $house_number_or_name = n
 				throw new InvalidArgumentException(
 					sprintf(
 						'Given postal code `%s` is longer then `%d` digits.',
-						$postal_code,
-						$max
+						\esc_html( $postal_code ),
+						\esc_html( $max )
 					)
 				);
 			}
@@ -164,8 +164,8 @@ public function __construct( $country, $street = null, $house_number_or_name = n
 				throw new InvalidArgumentException(
 					sprintf(
 						'Given state or province `%s` is longer then `%d` digits.',
-						$state_or_province,
-						$max
+						\esc_html( $state_or_province ),
+						\esc_html( $max )
 					)
 				);
 			}

src/Amount.php

@@ -43,7 +43,7 @@ public function __construct( $currency, $value ) {
 			throw new \InvalidArgumentException(
 				sprintf(
 					'Given currency `%s` not a three-character ISO currency code.',
-					$currency
+					\esc_html( $currency )
 				)
 			);
 		}

src/Client.php

@@ -73,8 +73,8 @@ private function send_request( $method, $request ) {
 			throw new \Exception(
 				\sprintf(
 					'Could not JSON decode Adyen response to an object, HTTP response: "%s", HTTP body: "%s".',
-					$response->status(),
-					$response->body()
+					\esc_html( $response->status() ),
+					\esc_html( $response->body() )
 				),
 				\intval( $response->status() )
 			);

src/Gateway.php

@@ -244,7 +244,7 @@ public function start( Payment $payment ) {
 			throw new \Exception(
 				\sprintf(
 					'The handling of the `%s` result code is not implemented.',
-					$result_code
+					\esc_html( $result_code )
 				)
 			);
 		}

src/Name.php

@@ -98,7 +98,7 @@ public function set_infix( $infix ) {
 			throw new InvalidArgumentException(
 				sprintf(
 					'Given infix `%s` is longer then 20 characters.',
-					$infix
+					\esc_html( $infix )
 				)
 			);
 		}