From c881ab2272bae94078066d32fb4e2f3e5ada8b1e Mon Sep 17 00:00:00 2001
From: HB9HIL <fabian.berg@hb9hil.org>
Date: Fri, 17 Nov 2023 16:44:30 +0100
Subject: [PATCH 1/2] added htmlspecialchars to comment

---
 application/views/qso/edit_ajax.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/views/qso/edit_ajax.php b/application/views/qso/edit_ajax.php
index f7e7d097..d5ea0d2b 100644
--- a/application/views/qso/edit_ajax.php
+++ b/application/views/qso/edit_ajax.php
@@ -187,7 +187,7 @@
 
                                 <div class="form-group">
                                     <label for="comment">Comment</label>
-                                    <input type="text" class="form-control" id="comment" name="comment" value="<?php echo $qso->COL_COMMENT; ?>">
+                                    <input type="text" class="form-control" id="comment" name="comment" value="<?php echo htmlspecialchars($qso->COL_COMMENT, ENT_QUOTES, 'UTF-8'); ?>">
                                 </div>
 
                                 <div class="form-row">

From ff2872de6518ae1b643591f3faa8abf409b1b5db Mon Sep 17 00:00:00 2001
From: HB9HIL <fabian.berg@hb9hil.org>
Date: Fri, 17 Nov 2023 16:53:59 +0100
Subject: [PATCH 2/2] special characters check

---
 application/views/qso/edit_ajax.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/views/qso/edit_ajax.php b/application/views/qso/edit_ajax.php
index d5ea0d2b..e49c954d 100644
--- a/application/views/qso/edit_ajax.php
+++ b/application/views/qso/edit_ajax.php
@@ -187,7 +187,7 @@
 
                                 <div class="form-group">
                                     <label for="comment">Comment</label>
-                                    <input type="text" class="form-control" id="comment" name="comment" value="<?php echo htmlspecialchars($qso->COL_COMMENT, ENT_QUOTES, 'UTF-8'); ?>">
+                                    <input type="text" class="form-control" id="comment" name="comment" value="<?php echo htmlspecialchars($qso->COL_COMMENT ? $qso->COL_COMMENT : '', ENT_QUOTES, 'UTF-8'); ?>">
                                 </div>
 
                                 <div class="form-row">