From f168daf94d433acc69deac665f0a40ae620867e6 Mon Sep 17 00:00:00 2001
From: Madeorsk <madeorsk@protonmail.com>
Date: Sat, 4 May 2019 11:53:21 +0200
Subject: [PATCH] Do not show HTML for items labels.

---
 views/poll.php    | 2 +-
 views/results.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/poll.php b/views/poll.php
index 45649e8..77fccf3 100644
--- a/views/poll.php
+++ b/views/poll.php
@@ -5,7 +5,7 @@
     <div class="option">
       <input type="<?= $poll->settings->multiple_choices ? "checkbox" : "radio" ?>" name="options[]" value="<?= $id ?>" id="option-<?= $id ?>" />
       <label for="option-<?= $id ?>" class="check"></label>
-      <label for="option-<?= $id ?>"><?= $option->label ?></label>
+      <label for="option-<?= $id ?>"><?= htmlspecialchars($option->label) ?></label>
     </div>
     <?php endforeach; ?>
     <input type="submit" value="Vote" />
diff --git a/views/results.php b/views/results.php
index bc1e9a0..9684129 100644
--- a/views/results.php
+++ b/views/results.php
@@ -11,7 +11,7 @@ foreach ($poll->options as $option)
       <?php foreach ($poll->options as $index => $option): ?>
       <tr>
         <td class="number"><?= $option->votes ?></td>
-        <td style="color: <?= $chart_colors[$index%$chart_colors_number] ?>"><?= $option->label ?></td>
+        <td style="color: <?= $chart_colors[$index%$chart_colors_number] ?>"><?= htmlspecialchars($option->label) ?></td>
         <td><?= $total_votes == 0 ? 0 : round($option->votes / $total_votes, 3)*100 ?>%</td>
       </tr>
       <?php endforeach; ?>