From 1ec48d46c956450ddf7b7c05588d84efc162235a Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Sun, 6 Nov 2022 00:04:40 -0600
Subject: [PATCH] Update contact_edit.php

---
 app/contacts/contact_edit.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/contacts/contact_edit.php b/app/contacts/contact_edit.php
index 14d85ecfa9..b052ddf1ee 100644
--- a/app/contacts/contact_edit.php
+++ b/app/contacts/contact_edit.php
@@ -2306,7 +2306,7 @@ if (permission_exists('contact_relation_view')) {
 			echo "			<div id='contacts' class='field no-wrap' style=\"width: auto; display: inline;\">\n";
 			echo "				<input class=\"formfld\" type=\"text\" name=\"contact_search\" placeholder=\"search\" style=\"width: 30%;\" onkeyup=\"get_contacts('contact_select_".$x."', 'contact_uuid', this.value);\" maxlength=\"255\" value=\"\">\n";
 			echo "				<select class='formfld' style=\"width: 70%;\" id=\"contact_select_".$x."\" name=\"contact_relations[".$x."][relation_contact_uuid]\" >\n";
-			echo "					<option value='".$row['relation_contact_uuid']."'>".$contact_name."</option>\n";
+			echo "					<option value='".escape($row['relation_contact_uuid'])."'>".escape($contact_name)."</option>\n";
 			echo "				</select>\n";
 			echo "			</div>\n";
 			echo "		</div>\n";
@@ -2655,7 +2655,6 @@ if (permission_exists('contact_note_view')) {
 	unset($contact_notes);
 }
 
-
 //close the grid
 	echo "</div>\n";
 	echo "<br /><br />";