'. t('Allowed HTML tags') .': '. drupal_specialchars($allowed_html) .'
';
+ $output = ''. t('Allowed HTML tags') .': '. check_plain($allowed_html) .'
';
if (!variable_get("filter_html_help_$format", 1)) {
return $output;
}
@@ -111,14 +111,14 @@ function filter_filter_tips($delta, $format, $long = false) {
if ($tips[$tag]) {
$rows[] = array(
array('data' => $tips[$tag][0], 'class' => 'description'),
- array('data' => '';
// Add hidden 'op' variable, which specifies the default operation (Preview).
- $output .= '
\n";
+ $output .= '
\n";
// Add the admin-specific parts.
if (user_access('administer nodes')) {
@@ -1455,7 +1454,7 @@ function node_edit($id) {
$node = node_load(array('nid' => $id));
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
$output = node_form($node);
@@ -1560,7 +1559,7 @@ function node_submit(&$node) {
// perform this operation:
if (node_access('update', $node)) {
$node->nid = node_save($node);
- watchdog('content', t('%type: updated %title.', array('%type' => '
'. t($node->type) .' ', '%title' => "
$node->title ")), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
+ watchdog('content', t('%type: updated %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
$msg = t('The %post was updated.', array ('%post' => node_invoke($node, 'node_name')));
}
}
@@ -1569,7 +1568,7 @@ function node_submit(&$node) {
// perform this operation:
if (node_access('create', $node)) {
$node->nid = node_save($node);
- watchdog('content', t('%type: added %title.', array('%type' => '
'. t($node->type) .' ', '%title' => "
$node->title ")), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
+ watchdog('content', t('%type: added %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
$msg = t('Your %post was created.', array ('%post' => node_invoke($node, 'node_name')));
}
}
@@ -1603,12 +1602,12 @@ function node_delete($edit) {
search_wipe($node->nid, 'node');
}
- watchdog('content', t('%type: deleted %title.', array('%type' => '
'. t($node->type) .' ', '%title' => "
$node->title ")));
+ watchdog('content', t('%type: deleted %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))));
}
else {
$extra = form_hidden('nid', $node->nid);
$output = theme('confirm',
- t('Are you sure you want to delete %title?', array('%title' => '
'. $node->title .' ')),
+ t('Are you sure you want to delete %title?', array('%title' => theme('placeholder', $node->title))),
$_GET['destination'] ? $_GET['destination'] : 'node/'. $node->nid,
t('This action cannot be undone.'),
t('Delete'),
@@ -1681,7 +1680,7 @@ function node_page() {
if (is_numeric(arg(1))) {
$node = node_load(array('nid' => arg(1)), $_GET['revision']);
if ($node->nid) {
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
print theme('page', node_show($node, arg(2)));
}
else {
@@ -1758,7 +1757,7 @@ function node_update_index() {
// Allow modules to change $node->body before viewing.
node_invoke_nodeapi($node, 'view', false, false);
- $text = '
'. drupal_specialchars($node->title) .' '. $node->body;
+ $text = '
'. check_plain($node->title) .' '. $node->body;
// Fetch extra data normally not visible
$extra = node_invoke_nodeapi($node, 'update index');
diff --git a/modules/node/node.module b/modules/node/node.module
index 29aae45cb700..adf40d94cf40 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -990,7 +990,7 @@ function node_revision_overview($nid) {
if (user_access('administer nodes')) {
$node = node_load(array('nid' => $nid));
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
if ($node->revisions) {
$header = array(t('Older revisions'), array('colspan' => '3', 'data' => t('Operations')));
@@ -1059,7 +1059,7 @@ function node_revision_rollback($nid, $revision) {
node_save($rev, $filter);
- drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "
#$revision ", '%title' => "
$node->title ")));
+ drupal_set_message(t('Rolled back to revision %revision of %title', array('%revision' => "
#$revision ", '%title' => theme('placeholder', $node->title))));
drupal_goto('node/'. $nid .'/revisions');
}
}
@@ -1075,7 +1075,7 @@ function node_revision_delete($nid, $revision) {
node_save($node, array('nid', 'revisions'));
- drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "
#$revision ", '%title' => "
$node->title ")));
+ drupal_set_message(t('Deleted revision %revision of %title', array('%revision' => "
#$revision ", '%title' => theme('placeholder', $node->title))));
drupal_goto('node/'. $nid . (count($node->revisions) ? '/revisions' : ''));
}
}
@@ -1199,9 +1199,8 @@ function node_validate($node) {
// Validate the title field.
if (isset($node->title)) {
- $node->title = strip_tags($node->title);
- if (!$node->title) {
- form_set_error('title', t('You have to specify a valid title.'));
+ if (trim($node->title) == '') {
+ form_set_error('title', t('You have to specify a title.'));
}
}
@@ -1242,7 +1241,7 @@ function node_validate($node) {
$node->uid = $account->uid;
}
else {
- form_set_error('name', t('The name %name does not exist.', array ('%name' => "
$node->name ")));
+ form_set_error('name', t('The username %name does not exist.', array ('%name' => theme('placeholder', $node->name))));
}
// Validate the "authored on" field.
@@ -1309,7 +1308,7 @@ function node_form($edit) {
$output .= '
';
// Add hidden 'op' variable, which specifies the default operation (Preview).
- $output .= ''. t($node->type) .' ', '%title' => "$node->title ")), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
+ watchdog('content', t('%type: updated %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), 'node/'. $node->nid));
$msg = t('The %post was updated.', array ('%post' => node_invoke($node, 'node_name')));
}
}
@@ -1569,7 +1568,7 @@ function node_submit(&$node) {
// perform this operation:
if (node_access('create', $node)) {
$node->nid = node_save($node);
- watchdog('content', t('%type: added %title.', array('%type' => ''. t($node->type) .' ', '%title' => "$node->title ")), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
+ watchdog('content', t('%type: added %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))), WATCHDOG_NOTICE, l(t('view'), "node/$node->nid"));
$msg = t('Your %post was created.', array ('%post' => node_invoke($node, 'node_name')));
}
}
@@ -1603,12 +1602,12 @@ function node_delete($edit) {
search_wipe($node->nid, 'node');
}
- watchdog('content', t('%type: deleted %title.', array('%type' => ''. t($node->type) .' ', '%title' => "$node->title ")));
+ watchdog('content', t('%type: deleted %title.', array('%type' => theme('placeholder', t($node->type)), '%title' => theme('placeholder', $node->title))));
}
else {
$extra = form_hidden('nid', $node->nid);
$output = theme('confirm',
- t('Are you sure you want to delete %title?', array('%title' => ''. $node->title .' ')),
+ t('Are you sure you want to delete %title?', array('%title' => theme('placeholder', $node->title))),
$_GET['destination'] ? $_GET['destination'] : 'node/'. $node->nid,
t('This action cannot be undone.'),
t('Delete'),
@@ -1681,7 +1680,7 @@ function node_page() {
if (is_numeric(arg(1))) {
$node = node_load(array('nid' => arg(1)), $_GET['revision']);
if ($node->nid) {
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
print theme('page', node_show($node, arg(2)));
}
else {
@@ -1758,7 +1757,7 @@ function node_update_index() {
// Allow modules to change $node->body before viewing.
node_invoke_nodeapi($node, 'view', false, false);
- $text = '
'. drupal_specialchars($node->title) .' '. $node->body;
+ $text = ''. check_plain($node->title) .' '. $node->body;
// Fetch extra data normally not visible
$extra = node_invoke_nodeapi($node, 'update index');
diff --git a/modules/path.module b/modules/path.module
index e48589c057e0..ba2251490dfa 100644
--- a/modules/path.module
+++ b/modules/path.module
@@ -296,15 +296,15 @@ function path_save($edit) {
$pid = $edit['pid'];
if (!valid_url($src)) {
- form_set_error('src', t('The system path %path is invalid.', array('%path' => "$src ")));
+ form_set_error('src', t('The system path %path is invalid.', array('%path' => theme('placeholder', $src))));
}
if (!valid_url($dst)) {
- form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => "$dst ")));
+ form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => theme('placeholder', $dst))));
}
if (db_result(db_query("SELECT COUNT(dst) FROM {url_alias} WHERE pid != %d AND dst = '%s'", $pid, $dst))) {
- form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => "$dst ")));
+ form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => theme('placeholder', $dst))));
}
if (form_get_errors()) {
diff --git a/modules/path/path.module b/modules/path/path.module
index e48589c057e0..ba2251490dfa 100644
--- a/modules/path/path.module
+++ b/modules/path/path.module
@@ -296,15 +296,15 @@ function path_save($edit) {
$pid = $edit['pid'];
if (!valid_url($src)) {
- form_set_error('src', t('The system path %path is invalid.', array('%path' => "$src ")));
+ form_set_error('src', t('The system path %path is invalid.', array('%path' => theme('placeholder', $src))));
}
if (!valid_url($dst)) {
- form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => "$dst ")));
+ form_set_error('dst', t('The alias %alias is invalid.', array('%alias' => theme('placeholder', $dst))));
}
if (db_result(db_query("SELECT COUNT(dst) FROM {url_alias} WHERE pid != %d AND dst = '%s'", $pid, $dst))) {
- form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => "$dst ")));
+ form_set_error('dst', t('The alias %alias is already in use.', array('%alias' => theme('placeholder', $dst))));
}
if (form_get_errors()) {
diff --git a/modules/poll.module b/modules/poll.module
index d5eae590a48c..933c1067ac24 100644
--- a/modules/poll.module
+++ b/modules/poll.module
@@ -307,9 +307,9 @@ function poll_view_voting(&$node, $teaser, $page, $block) {
if ($node->choice) {
$list = array();
foreach ($node->choice as $i => $choice) {
- $list[$i] = drupal_specialchars($choice['chtext']);
+ $list[$i] = check_plain($choice['chtext']);
}
- $form .= form_radios($page ? '' : $node->title, 'choice', -1, $list);
+ $form .= form_radios($page ? '' : check_plain($node->title), 'choice', -1, $list);
}
$form .= '';
$form .= form_hidden('nid', $node->nid);
@@ -336,12 +336,12 @@ function poll_view_results(&$node, $teaser, $page, $block) {
// Output the divs for the text, bars and percentages
$output .= '
';
if ($block) {
- $output .= '
'. $node->title .'
';
+ $output .= '
'. check_plain($node->title) .'
';
}
foreach ($node->choice as $i => $choice) {
if ($choice['chtext'] != '') {
$percentage = round($choice['chvotes'] * 100 / max($votestotal, 1));
- $output .= '
'. drupal_specialchars($choice['chtext']) .'
';
+ $output .= '
'. check_plain($choice['chtext']) .'
';
$output .= '
';
$output .= '
';
$output .= '
';
@@ -360,7 +360,7 @@ function poll_view_results(&$node, $teaser, $page, $block) {
*/
function poll_results() {
if ($node = node_load(array('nid' => arg(1)))) {
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
print theme('page', node_show($node, 0));
}
else {
diff --git a/modules/poll/poll.module b/modules/poll/poll.module
index d5eae590a48c..933c1067ac24 100644
--- a/modules/poll/poll.module
+++ b/modules/poll/poll.module
@@ -307,9 +307,9 @@ function poll_view_voting(&$node, $teaser, $page, $block) {
if ($node->choice) {
$list = array();
foreach ($node->choice as $i => $choice) {
- $list[$i] = drupal_specialchars($choice['chtext']);
+ $list[$i] = check_plain($choice['chtext']);
}
- $form .= form_radios($page ? '' : $node->title, 'choice', -1, $list);
+ $form .= form_radios($page ? '' : check_plain($node->title), 'choice', -1, $list);
}
$form .= '
';
$form .= form_hidden('nid', $node->nid);
@@ -336,12 +336,12 @@ function poll_view_results(&$node, $teaser, $page, $block) {
// Output the divs for the text, bars and percentages
$output .= '
';
if ($block) {
- $output .= '
'. $node->title .'
';
+ $output .= '
'. check_plain($node->title) .'
';
}
foreach ($node->choice as $i => $choice) {
if ($choice['chtext'] != '') {
$percentage = round($choice['chvotes'] * 100 / max($votestotal, 1));
- $output .= '
'. drupal_specialchars($choice['chtext']) .'
';
+ $output .= '
'. check_plain($choice['chtext']) .'
';
$output .= '
';
$output .= '
';
$output .= '
';
@@ -360,7 +360,7 @@ function poll_view_results(&$node, $teaser, $page, $block) {
*/
function poll_results() {
if ($node = node_load(array('nid' => arg(1)))) {
- drupal_set_title($node->title);
+ drupal_set_title(check_plain($node->title));
print theme('page', node_show($node, 0));
}
else {
diff --git a/modules/profile.module b/modules/profile.module
index 8e9c2bdbc040..d47caa4003ef 100644
--- a/modules/profile.module
+++ b/modules/profile.module
@@ -107,7 +107,7 @@ function profile_browse() {
$output .= theme('pager', NULL, 20);
if ($field->type == 'selection' || $field->type == 'list') {
- $title = strtr($field->page, array('%value' => $value));
+ $title = strtr($field->page, array('%value' => theme('placeholder', $value)));
}
else {
$title = $field->page;
@@ -178,15 +178,15 @@ function profile_view_field($user, $field) {
if ($value = $user->{$field->name}) {
switch ($field->type) {
case 'textfield':
- return drupal_specialchars($value);
+ return check_plain($value);
case 'textarea':
return check_output($value);
case 'selection':
- return $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+ return $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
case 'checkbox':
- return $browse ? l(strip_tags($field->title), "profile/$field->name") : drupal_specialchars($field->title);
+ return $browse ? l($field->title, "profile/$field->name") : check_plain($field->title);
case 'url':
- return '
'. drupal_specialchars($value) .' ';
+ return '
'. check_plain($value) .' ';
case 'date':
list($format) = explode(' - ', variable_get('date_format_short', 'm/d/Y - H:i'), 2);
// Note: we avoid PHP's date() because it does not handle dates before
@@ -203,7 +203,7 @@ function profile_view_field($user, $field) {
$fields = array();
foreach ($values as $value) {
if ($value = trim($value)) {
- $fields[] = $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+ $fields[] = $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
}
}
return implode(', ', $fields);
@@ -226,7 +226,7 @@ function profile_view_profile($user) {
while ($field = db_fetch_object($result)) {
if ($value = profile_view_field($user, $field)) {
$description = ($field->visibility == PROFILE_PRIVATE) ? t('The content of this field is private and only visible to yourself.') : '';
- $title = ($field->type != 'checkbox') ? $field->title : '';
+ $title = ($field->type != 'checkbox') ? check_plain($field->title) : '';
$fields[$field->category] .= form_item($title, $value, $description);
}
}
@@ -264,16 +264,16 @@ function profile_form_profile($edit, $user, $category) {
switch ($field->type) {
case 'textfield':
case 'url':
- $fields[$category] .= form_textfield($field->title, $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textfield(check_plain($field->title), $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
break;
case 'textarea':
- $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
break;
case 'list':
- $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
break;
case 'checkbox':
- $fields[$category] .= form_checkbox($field->title, $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_checkbox(check_plain($field->title), $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
break;
case 'selection':
$options = array('--');
@@ -284,7 +284,7 @@ function profile_form_profile($edit, $user, $category) {
}
}
- $fields[$category] .= form_select($field->title, $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
+ $fields[$category] .= form_select(check_plain($field->title), $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
break;
case 'date':
$fields[$category] .= _profile_date_field($field, $edit);
@@ -338,7 +338,7 @@ function _profile_date_field($field, $edit) {
}
$output .= '
';
- return form_item($field->title, $output, _profile_form_explanation($field), NULL, $field->required);
+ return form_item(check_plain($field->title), $output, _profile_form_explanation($field), NULL, $field->required);
}
/**
@@ -362,12 +362,12 @@ function profile_validate_profile($edit, $category) {
if ($edit[$field->name]) {
if ($field->type == 'url') {
if (!valid_url($edit[$field->name], true)) {
- form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => "
$field->title ")));
- }
+ form_set_error($field->name, t('The value provided for %field is not a valid URL.', array('%field' => theme('placeholder', $field->title))));
+ }
}
}
else if ($field->required && !user_access('administer users')) {
- form_set_error($field->name, t('The field %field is required.', array('%field' => "
$field->title ")));
+ form_set_error($field->name, t('The field %field is required.', array('%field' => theme('placeholder', $field->title))));
}
}
@@ -377,7 +377,7 @@ function profile_validate_profile($edit, $category) {
function profile_categories() {
$result = db_query("SELECT DISTINCT(category) FROM {profile_fields}");
while ($category = db_fetch_object($result)) {
- $data[] = array('name' => drupal_specialchars($category->category), 'title' => $category->category, 'weight' => 3);
+ $data[] = array('name' => check_plain($category->category), 'title' => $category->category, 'weight' => 3);
}
return $data;
}
@@ -539,7 +539,7 @@ function profile_admin_overview() {
$result = db_query('SELECT * FROM {profile_fields} ORDER BY category, weight');
$rows = array();
while ($field = db_fetch_object($result)) {
- $rows[] = array($field->title, $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
+ $rows[] = array(check_plain($field->title), $field->name, _profile_field_types($field->type), $field->category, l(t('edit'), "admin/settings/profile/edit/$field->fid"), l(t('delete'), "admin/settings/profile/delete/$field->fid"));
}
if (count($rows) == 0) {
$rows[] = array(array('data' => t('No fields defined.'), 'colspan' => '6'));
diff --git a/modules/profile/profile.module b/modules/profile/profile.module
index 8e9c2bdbc040..d47caa4003ef 100644
--- a/modules/profile/profile.module
+++ b/modules/profile/profile.module
@@ -107,7 +107,7 @@ function profile_browse() {
$output .= theme('pager', NULL, 20);
if ($field->type == 'selection' || $field->type == 'list') {
- $title = strtr($field->page, array('%value' => $value));
+ $title = strtr($field->page, array('%value' => theme('placeholder', $value)));
}
else {
$title = $field->page;
@@ -178,15 +178,15 @@ function profile_view_field($user, $field) {
if ($value = $user->{$field->name}) {
switch ($field->type) {
case 'textfield':
- return drupal_specialchars($value);
+ return check_plain($value);
case 'textarea':
return check_output($value);
case 'selection':
- return $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+ return $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
case 'checkbox':
- return $browse ? l(strip_tags($field->title), "profile/$field->name") : drupal_specialchars($field->title);
+ return $browse ? l($field->title, "profile/$field->name") : check_plain($field->title);
case 'url':
- return '
'. drupal_specialchars($value) .' ';
+ return '
'. check_plain($value) .' ';
case 'date':
list($format) = explode(' - ', variable_get('date_format_short', 'm/d/Y - H:i'), 2);
// Note: we avoid PHP's date() because it does not handle dates before
@@ -203,7 +203,7 @@ function profile_view_field($user, $field) {
$fields = array();
foreach ($values as $value) {
if ($value = trim($value)) {
- $fields[] = $browse ? l(drupal_specialchars($value), "profile/$field->name/". check_url($value)) : drupal_specialchars($value);
+ $fields[] = $browse ? l($value, "profile/$field->name/$value") : check_plain($value);
}
}
return implode(', ', $fields);
@@ -226,7 +226,7 @@ function profile_view_profile($user) {
while ($field = db_fetch_object($result)) {
if ($value = profile_view_field($user, $field)) {
$description = ($field->visibility == PROFILE_PRIVATE) ? t('The content of this field is private and only visible to yourself.') : '';
- $title = ($field->type != 'checkbox') ? $field->title : '';
+ $title = ($field->type != 'checkbox') ? check_plain($field->title) : '';
$fields[$field->category] .= form_item($title, $value, $description);
}
}
@@ -264,16 +264,16 @@ function profile_form_profile($edit, $user, $category) {
switch ($field->type) {
case 'textfield':
case 'url':
- $fields[$category] .= form_textfield($field->title, $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textfield(check_plain($field->title), $field->name, $edit[$field->name], 70, 255, _profile_form_explanation($field), NULL, $field->required);
break;
case 'textarea':
- $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
break;
case 'list':
- $fields[$category] .= form_textarea($field->title, $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_textarea(check_plain($field->title), $field->name, $edit[$field->name], 70, 5, _profile_form_explanation($field), NULL, $field->required);
break;
case 'checkbox':
- $fields[$category] .= form_checkbox($field->title, $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
+ $fields[$category] .= form_checkbox(check_plain($field->title), $field->name, 1, $edit[$field->name], _profile_form_explanation($field), NULL, $field->required);
break;
case 'selection':
$options = array('--');
@@ -284,7 +284,7 @@ function profile_form_profile($edit, $user, $category) {
}
}
- $fields[$category] .= form_select($field->title, $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
+ $fields[$category] .= form_select(check_plain($field->title), $field->name, $edit[$field->name], $options, _profile_form_explanation($field), 0, 0, $field->required);
break;
case 'date':
$fields[$category] .= _profile_date_field($field, $edit);
@@ -338,7 +338,7 @@ function _profile_date_field($field, $edit) {
}
$output .= '