@@ -10,7 +10,7 @@ class Fortune extends Base
*/
public function getAll()
{
- $sth = $this->pdo->prepare('SELECT * FROM Fortune');
+ $sth = $this->pdo->prepare('SELECT * FROM Fortune ORDER BY Fortune.message');
$sth->execute();
return $sth->fetchAll(\PDO::FETCH_ASSOC);
@@ -1,4 +1,4 @@
<tr>
<td><?php echo $this->id ?></td>
- <td><?php echo \Pimf\Param::filter($this->message) ?></td>
+ <td><?php echo e($this->message) ?></td>
</tr>
@@ -35,3 +35,15 @@ function url($route = '', array $params = array(), $https = null, $asset = false
return \Pimf\Url::compute($route, $params, $https, $asset);
}
+
+/**
+ * Escape HTML entities in a string.
+ *
+ * @param string $value
+ * @return string
+ */
+function e($value)
+{
+ return htmlentities($value, ENT_QUOTES, 'UTF-8', false);
+}