fix: added missing conversion to HTML entities

thorsten · Nov 1, 2022 · 0f57bb0 · 0f57bb0
1 parent 137cc2b
commit 0f57bb0
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/phpmyfaq/src/phpMyFAQ/Helper/CategoryHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/CategoryHelper.php
@@ -20,6 +20,7 @@
 use phpMyFAQ\Database;
 use phpMyFAQ\Helper;
 use phpMyFAQ\Link;
+use phpMyFAQ\Strings;
 use phpMyFAQ\User;
 
 /**
@@ -351,7 +352,8 @@ public function renderStartPageCategories(array $categories): string
             $decks .= '</a>' .
                 '<div class="card-body">' .
                 '<h4 class="card-title text-center">' .
-                '<a href="' . $category['url'] . '">' . $category['name'] . '</a>' .
+                '<a href="' . Strings::htmlentities($category['url']) . '">' .
+                Strings::htmlentities($category['name']) . '</a>' .
                 '</h4>' .
                 '<p class="card-text">' . $category['description'] . '</p>' .
                 '</div>' .