From b03238b4c31c9616d2dbbec9fc50a0feaf462944 Mon Sep 17 00:00:00 2001
From: Minh Cuong Tran <minh-cuong.tran@schulergroup.com>
Date: Fri, 1 Mar 2024 08:03:31 +0100
Subject: [PATCH] Fix Security: Stored Cross Site Scripting for static QR code,
 see https://github.com/giandonatoinverso/PHP-Dynamic-Qr-code/issues/93

---
 src/lib/StaticQrcode/StaticQrcode.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/StaticQrcode/StaticQrcode.php b/src/lib/StaticQrcode/StaticQrcode.php
index 5446c44..5bfe02b 100644
--- a/src/lib/StaticQrcode/StaticQrcode.php
+++ b/src/lib/StaticQrcode/StaticQrcode.php
@@ -355,7 +355,7 @@ class StaticQrcode {
         $data_to_db['type'] = $type;
         $data_to_db['format'] = $_POST['format'];
         $data_to_db['qrcode'] = $data_to_db['filename'].'.'.$data_to_db['format'];
-        $data_to_db['content'] = $this->sContent;
+        $data_to_db['content'] = htmlspecialchars($this->sContent, ENT_QUOTES, 'UTF-8');
 
         if(isset($_POST['level']))
             $input_data["level"] = $_POST['level'];