From d1e1dbf891c76d45c44490977383c08df0210c0b Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@users.mediawiki.org>
Date: Thu, 14 Oct 2004 06:21:33 +0000
Subject: [PATCH] Escape HTMl output

---
 includes/SpecialPreferences.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/SpecialPreferences.php b/includes/SpecialPreferences.php
index 57f857bb4c..893479304c 100644
--- a/includes/SpecialPreferences.php
+++ b/includes/SpecialPreferences.php
@@ -526,7 +526,7 @@ class PreferencesForm {
 		<legend>$timezone</legend>
 		<div><b>$tzServerTime:</b> $nowserver</div>
 		<div><b>$ltz:</b> $nowlocal</div>
-		<div><label>$tzo*: <input type='text' name=\"wpHourDiff\" value=\"{$this->mHourDiff}\" size='6' /></label></div>
+		<div><label>$tzo*: <input type='text' name=\"wpHourDiff\" value=\"" . htmlspecialchars( $this->mHourDiff ) . "\" size='6' /></label></div>
 		<div><input type=\"button\" value=\"$tzGuess\" onclick=\"javascript:guessTimezone()\" id=\"guesstimezonebutton\" style=\"display:none\" /></div>
 		<div class='prefsectiontip'>* {$tzt}</div>
 	</fieldset>\n\n" );
-- 
2.20.1