From 65d28c72a4a2335e4b814bbc9ff1fffe700dcd95 Mon Sep 17 00:00:00 2001
From: maxpozdeev <maxpozdeev@gmail.com>
Date: Tue, 6 Sep 2022 21:28:31 +0300
Subject: [PATCH] escape translated vars in _e()

---
 src/init.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/init.php b/src/init.php
index 09a8339..fd2f526 100644
--- a/src/init.php
+++ b/src/init.php
@@ -235,7 +235,7 @@ function formatTime($format, $timestamp=0) : string
 
 function _e($s)
 {
-    echo Lang::instance()->get($s);
+    echo htmlspecialchars(Lang::instance()->get($s));
 }
 
 function __($s)