Tags: bupy7/php-html-form
Tags
Don't escape label contents Trying to protect against XSS in the case that someone is using user input for label contents is not worth the trade-off of disallowing users of the library to customize the HTML contents of their labels. If you are using user input in your labels, I recommend escaping that data manually before including it in your label.
Merge pull request adamwathan#118 from JesseLeite/fix-xss Fixing XSS vulnerabilities
PreviousNext