HTML escape substituted parameter values to avoid injection attacks.

[rails.git] / app / views / message / new.rhtml

diff --git a/app/views/message/new.rhtml b/app/views/message/new.rhtml
index 883fdfbc0ca9e02d67b070936df454042b73c0a4..27c50132218e0388d7e27fba2eea93c0eb81d360 100644 (file)
--- a/app/views/message/new.rhtml
+++ b/app/views/message/new.rhtml
@@ -3,7 +3,7 @@
 <h2>Send a new message to <%= display_name %></h2>
 
 <% if params[:display_name] %>
-<p>Writing a new message to <%= params[:display_name] %></p>  
+<p>Writing a new message to <%= h(params[:display_name]) %></p>  
 <p>TODO: drop down box of your friends</p>
 <%end%>