From 58c990f8eac52d4074e9231809b5d9b971e8e0c7 Mon Sep 17 00:00:00 2001
From: Brian Miyaji <brian@themeboy.com>
Date: Wed, 30 Sep 2015 14:41:22 +1000
Subject: [PATCH] Allow special HTML characters in player list fields

---
 .../admin/post-types/meta-boxes/class-sp-meta-box-list-data.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
index 6a8fd6c4..065ddca9 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
@@ -124,7 +124,7 @@ class SP_Meta_Box_List_Data {
 									$value = sp_array_value( $player_stats, $column, '' );
 									$placeholder = sp_array_value( sp_array_value( $placeholders, $player_id, array() ), $column, 0 );
 									?>
-									<td><input type="text" name="sp_players[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo $value; ?>" placeholder="<?php echo $placeholder; ?>" data-placeholder="<?php echo $placeholder; ?>" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
+									<td><input type="text" name="sp_players[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo htmlspecialchars( $value ); ?>" placeholder="<?php echo htmlspecialchars( $placeholder ); ?>" data-placeholder="<?php echo htmlspecialchars( $placeholder ); ?>" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
 								<?php endforeach; ?>
 							</tr>
 							<?php