Escape output vars of includes files (#1)

2021-11-06 12:34:49 +02:00
parent 0c9a9dc104
commit e24a9fa4eb
4 changed files with 10 additions and 10 deletions
--- a/includes/class-sp-shortcodes.php
+++ b/includes/class-sp-shortcodes.php
@@ -66,9 +66,9 @@ class SP_Shortcodes {
 		$before 	= empty( $wrapper['before'] ) ? '<div class="' . esc_attr( $wrapper['class'] ) . '">' : $wrapper['before'];
 		$after 		= empty( $wrapper['after'] ) ? '</div>' : $wrapper['after'];

-		echo $before;
+		echo esc_html( $before );
 		call_user_func( $function, $atts );
-		echo $after;
+		echo esc_html( $after );

 		return ob_get_clean();
 	}