Autocomplete: Escape HTML tags in callback name to avoid XSS in demo

Fixes #15048

1 files changed, 4 insertions, 1 deletions

diff --git a/demos/autocomplete/search.php b/demos/autocomplete/search.php
index 489b30c1e..6ab404ccb 100644
--- a/demos/autocomplete/search.php
+++ b/demos/autocomplete/search.php
@@ -586,7 +586,10 @@ foreach ($items as $key=>$value) {
 $output = json_encode($result);
 
 if ($_GET["callback"]) {
-	$output = $_GET["callback"] . "($output);";
+	// Escape special characters to avoid XSS attacks via direct loads of this
+	// page with a callback that contains HTML. This is a lot easier than validating
+	// the callback name.
+	$output = htmlspecialchars($_GET["callback"]) . "($output);";
 }
 
 echo $output;