From 4de22df2f592328026479ad9a3b68ca0b9b3e630 Mon Sep 17 00:00:00 2001
From: AlexanderDCrane <40072887+AlexanderDCrane@users.noreply.github.com>
Date: Sat, 9 Jun 2018 11:39:29 -0600
Subject: [PATCH] Escape user data on conference_profile_edit.php (#3098)

---
 app/conference_profiles/conference_profile_edit.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/conference_profiles/conference_profile_edit.php b/app/conference_profiles/conference_profile_edit.php
index ee642aba2f..23b4289dc6 100644
--- a/app/conference_profiles/conference_profile_edit.php
+++ b/app/conference_profiles/conference_profile_edit.php
@@ -142,7 +142,7 @@
 	echo "	".$text['label-profile_name']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_name' maxlength='255' value=\"$profile_name\">\n";
+	echo "	<input class='formfld' type='text' name='profile_name' maxlength='255' value=\"".escape($profile_name)."\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_name']."\n";
 	echo "</td>\n";
@@ -178,7 +178,7 @@
 	echo "	".$text['label-profile_description']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_description' maxlength='255' value=\"$profile_description\">\n";
+	echo "	<input class='formfld' type='text' name='profile_description' maxlength='255' value=\"".escape($profile_description)."\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_description']."\n";
 	echo "</td>\n";
@@ -186,7 +186,7 @@
 	echo "	<tr>\n";
 	echo "		<td colspan='2' align='right'>\n";
 	if ($action == "update") {
-		echo "				<input type='hidden' name='conference_profile_uuid' value='$conference_profile_uuid'>\n";
+		echo "				<input type='hidden' name='conference_profile_uuid' value='".escape($conference_profile_uuid)."'>\n";
 	}
 	echo "				<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "		</td>\n";