From a0b6207f81aeb6108eea58faf6ca156adeb58d41 Mon Sep 17 00:00:00 2001
From: Joshua Ramon Enslin <joshua@museum-digital.de>
Date: Sun, 15 Aug 2021 20:03:25 +0200
Subject: [PATCH] Add missing htmlspecialchars in Wikidata results list

---
 src/NodaWikidataFetcher.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/NodaWikidataFetcher.php b/src/NodaWikidataFetcher.php
index 02ea7b1..e598542 100644
--- a/src/NodaWikidataFetcher.php
+++ b/src/NodaWikidataFetcher.php
@@ -1688,7 +1688,7 @@ final class NodaWikidataFetcher {
             return '';
         }
 
-        $output = '<div><a href="' . $link . 'suchbegriff=' . $searchTerm . '&wikidata_id=' . $result['id'] . '&lang=' . $lang . '">
+        $output = '<div><a href="' . $link . 'suchbegriff=' . htmlspecialchars($searchTerm) . '&wikidata_id=' . htmlspecialchars((string)$result['id']) . '&lang=' . htmlspecialchars($lang) . '">
             <h4 class="icons iconsTag">' . $result['id'] . '</h4>';
         $output .= '<p class="wikidataSummary">' . $result['label'];
         if (!empty($result['label_ext'])) $output .= " (<span class='icons iconsTranslate'>{$result['label_ext']}</span>)";