From 7cd6e0b17dd10b1a8e6cac4df180230bdff7eb77 Mon Sep 17 00:00:00 2001
From: Steven Wittens <steven@10.no-reply.drupal.org>
Date: Tue, 21 May 2002 16:00:39 +0000
Subject: The default form action (request_uri) didn't escape HTML entities
 (such as &amp;)

---
 includes/common.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'includes')

diff --git a/includes/common.inc b/includes/common.inc
index 82674223e..1634d641b 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -567,7 +567,7 @@ function format_tag($link, $text) {
 }
 
 function form($form, $method = "post", $action = 0, $options = 0) {
-  return "<form action=\"". ($action ? $action : request_uri()) ."\" method=\"$method\"". ($options ? " $options" : "") .">\n$form</form>\n";
+  return "<form action=\"". ($action ? $action : htmlentities(request_uri())) ."\" method=\"$method\"". ($options ? " $options" : "") .">\n$form</form>\n";
 }
 
 function form_item($title, $value, $description = 0) {
-- 
cgit v1.2.3