Update persist_form_var.php

resources/persist_form_var.php

@@ -17,26 +17,26 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <[email protected]>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <[email protected]>
 */
 
-function persistformvar($formarray) {
+function persistformvar($form_array) {
 	// Remember Form Input Values
-	if(is_array($formarray)) {
-	  $content .= "<form method='post' action='".$_SERVER["HTTP_REFERER"]."' target='_self'>\n";
-	 foreach($formarray as $key => $val) {
-	   if($key == "XID" || $key == "ACT" || $key == "RET") continue;
-       if ($key != "persistform") { //clears the persistform value
-            $content .= "<input type='hidden' name='$key' value='$val' />\n";
-       }
-	 }
-    	$content .= "<input type='hidden' name='persistformvar' value='true' />\n"; //sets persistform to yes
-	 $content .= "<input class='btn' type='submit' value='Back' />\n";
-	 $content .= "</form>\n";
+	if (is_array($form_array)) {
+		$content .= "<form method='post' action='".escape($_SERVER["HTTP_REFERER"])."' target='_self'>\n";
+		foreach($form_array as $key => $val) {
+			if ($key == "XID" || $key == "ACT" || $key == "RET") continue;
+			if ($key != "persistform") { //clears the persistform value
+				$content .= "	<input type='hidden' name='".escape($key)."' value='".escape($val)."' />\n";
+			}
+		}
+		$content .= "	<input type='hidden' name='persistformvar' value='true' />\n"; //sets persistform to yes
+		$content .= "	<input class='btn' type='submit' value='Back' />\n";
+		$content .= "</form>\n";
 	}
 	echo $content;
 	//return $content;