From e9f155fb49aa99838a710a0568923e87bc0718f3 Mon Sep 17 00:00:00 2001
From: slawkens <slawkens@gmail.com>
Date: Sat, 16 Sep 2023 10:20:34 +0200
Subject: [PATCH] Fix XSS in players editor

---
 admin/pages/players.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/pages/players.php b/admin/pages/players.php
index b409c15e..153601b7 100644
--- a/admin/pages/players.php
+++ b/admin/pages/players.php
@@ -872,7 +872,7 @@ else if (isset($_REQUEST['search'])) {
 					<form action="<?php echo $player_base; ?>" method="post">
 						<label for="name">Player Name:</label>
 						<div class="input-group input-group-sm">
-							<input type="text" class="form-control" name="search" value="<?php echo $search_player; ?>" maxlength="32" size="32">
+							<input type="text" class="form-control" id="search" name="search" value="<?= escapeHtml($search_player); ?>" maxlength="32" size="32">
 							<span class="input-group-append"><button type="submit" class="btn btn-info btn-flat">Search</button></span>
 						</div>
 					</form>