From 08e0bd7570b7927fe5abf971f4225e9ecebe76ed Mon Sep 17 00:00:00 2001
From: AlexanderDCrane <40072887+AlexanderDCrane@users.noreply.github.com>
Date: Mon, 27 Aug 2018 14:50:12 -0600
Subject: [PATCH] Update conference_profile_param_edit.php (#3288)

---
 app/conference_profiles/conference_profile_param_edit.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/conference_profiles/conference_profile_param_edit.php b/app/conference_profiles/conference_profile_param_edit.php
index 189be28747..cd91e12232 100644
--- a/app/conference_profiles/conference_profile_param_edit.php
+++ b/app/conference_profiles/conference_profile_param_edit.php
@@ -156,7 +156,7 @@
 	echo "	".$text['label-profile_param_name']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_name' maxlength='255' value=\"$profile_param_name\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_name' maxlength='255' value=\"".escape($profile_param_name).""\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_name']."\n";
 	echo "</td>\n";
@@ -167,7 +167,7 @@
 	echo "	".$text['label-profile_param_value']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_value' maxlength='255' value=\"$profile_param_value\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_value' maxlength='255' value=\"".escape($profile_param_value).""\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_value']."\n";
 	echo "</td>\n";
@@ -203,7 +203,7 @@
 	echo "	".$text['label-profile_param_description']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_description' maxlength='255' value=\"$profile_param_description\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_description' maxlength='255' value=\"".escape($profile_param_description).""\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_description']."\n";
 	echo "</td>\n";