From afdf8cfcaf2462dcc0ee5773373a06e80ec975ad Mon Sep 17 00:00:00 2001
From: AlexanderDCrane <40072887+AlexanderDCrane@users.noreply.github.com>
Date: Mon, 27 Aug 2018 20:26:24 -0600
Subject: [PATCH] Update device_setting_edit.php (#3297)

---
 app/devices/device_setting_edit.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/devices/device_setting_edit.php b/app/devices/device_setting_edit.php
index 8bf454fb6f..fac006657c 100644
--- a/app/devices/device_setting_edit.php
+++ b/app/devices/device_setting_edit.php
@@ -197,7 +197,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-category']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='device_setting_category' maxlength='255' value=\"$device_setting_category\">\n";
+	echo "	<input class='formfld' type='text' name='device_setting_category' maxlength='255' value=\"".escape($device_setting_category)."\">\n";
 	echo "<br />\n";
 	echo $text['description-category']."\n";
 	echo "</td>\n";
@@ -208,7 +208,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-subcategory']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='device_setting_subcategory' maxlength='255' value=\"$device_setting_subcategory\">\n";
+	echo "	<input class='formfld' type='text' name='device_setting_subcategory' maxlength='255' value=\"".escape($device_setting_subcategory)."\">\n";
 	echo "<br />\n";
 	echo $text['description-subcategory']."\n";
 	echo "</td>\n";
@@ -219,7 +219,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-type']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='device_setting_name' maxlength='255' value=\"$device_setting_name\">\n";
+	echo "	<input class='formfld' type='text' name='device_setting_name' maxlength='255' value=\"".escape($device_setting_name)."\">\n";
 	echo "<br />\n";
 	echo $text['description-type']."\n";
 	echo "</td>\n";
@@ -230,7 +230,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-value']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='device_setting_value' maxlength='255' value=\"$device_setting_value\">\n";
+	echo "	<input class='formfld' type='text' name='device_setting_value' maxlength='255' value=\"".escape($device_setting_value)."\">\n";
 	echo "<br />\n";
 	echo $text['description-value']."\n";
 	echo "</td>\n";
@@ -266,7 +266,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-description']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='device_setting_description' maxlength='255' value=\"$device_setting_description\">\n";
+	echo "	<input class='formfld' type='text' name='device_setting_description' maxlength='255' value=\"".escape($device_setting_description)."\">\n";
 	echo "<br />\n";
 	echo $text['description-description']."\n";
 	echo "</td>\n";
@@ -288,4 +288,4 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 
 //include the footer
 	require_once "resources/footer.php";
-?>
\ No newline at end of file
+?>