Working on shaarli/Shaarli#224

I reviewed character escaping everywhere with the following ideas:

  * use a single common function to escape user data: `escape` using `htmlspecialchars`.
  * sanitize fields in `index.php` after reading them from datastore and before sending them to templates.
  	It means no escaping function in Twig templates.
    2 reasons:
    * it reduces risks of security issue for future user made templates
    * more readable templates
  * sanitize user configuration fields after loading them.

1 files changed, 1 insertions, 1 deletions

diff --git a/tpl/page.header.html b/tpl/page.header.html
index 0fd65e40..2d186aa2 100644
--- a/tpl/page.header.html
+++ b/tpl/page.header.html
@@ -8,7 +8,7 @@
 <div id="menu">
   <ul>
       <li><span id="shaarli_title">
-        <a href="{$titleLink}">{$shaarlititle|htmlspecialchars}</a>
+        <a href="{$titleLink}">{$shaarlititle}</a>
     </span>
     </li>