From 62a1dd1912e36d26f242e42b7fa0ee4dddf8a456 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 9 May 2012 18:48:16 +0200
Subject: [PATCH] Fix: escape html tag value

---
 htdocs/core/lib/admin.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php
index fa963f792ff..3632e42811c 100644
--- a/htdocs/core/lib/admin.lib.php
+++ b/htdocs/core/lib/admin.lib.php
@@ -1105,7 +1105,7 @@ function form_constantes($tableau)
                 }
                 else
                 {
-                    print '<input type="text" class="flat" size="48" name="constvalue" value="'.$obj->value.'">';
+                    print '<input type="text" class="flat" size="48" name="constvalue" value="'.dol_escape_htmltag($obj->value).'">';
                     print '</td><td>';
                     print '<input type="hidden" name="consttype" value="chaine">';
                 }