if using older PHP version (like 7), the default flags for htmlspecialchars() are suboptimal, _sigh_HEADmaster

1 files changed, 5 insertions, 5 deletions

diff --git a/search.php b/search.php
index e61da1b..522eeaf 100644
--- a/search.php
+++ b/search.php
@@ -48,7 +48,7 @@
                 <nav id="search_pane">
                     <form>
                         <div id="query_wrap">
-                            <input  id="query"   type='search' value='<?= htmlspecialchars($query);?>' name='query' autocorrect="off" autocapitalize="none" required/>
+                            <input  id="query"   type='search' value='<?= htmlspecialchars($query, $hsc_flags);?>' name='query' autocorrect="off" autocapitalize="none" required/>
                             <button id="btn_def" type='submit' value='man' name='action' class="btn-def" aria-hidden="true" tabindex="-1"></button>
                             <input type="checkbox" id="query_opts_toggle"/>
                             <div id="query_opts">
@@ -75,7 +75,7 @@
                                             if((strlen($arch) > 0) && ($arch == $a))
                                                 $sel = 'selected="selected"';
 
-                                            $a = htmlspecialchars($a);
+                                            $a = htmlspecialchars($a, $hsc_flags);
                                             echo "<option value='$a' $sel>$a</option>";
                                         }
                                     ?>
@@ -182,9 +182,9 @@
                     $url = "$root/search.php?query=". urlencode($name) ."&section=". urlencode($sect)
                            ."&arch=". urlencode($arch) ."&action=man";
 
-                    $fname = htmlspecialchars($fname);
-                    $fsect = htmlspecialchars($fsect);
-                    $desc  = htmlspecialchars($desc);
+                    $fname = htmlspecialchars($fname, $hsc_flags);
+                    $fsect = htmlspecialchars($fsect, $hsc_flags);
+                    $desc  = htmlspecialchars($desc,  $hsc_flags);
 
                     echo '<dl>';
                     echo "  <dt><a href='".$url."'>$fname($fsect)</a></dt>";