From d3094f487a9d557dd8a922c4f72df62c53436fbf Mon Sep 17 00:00:00 2001
From: AlexanderDCrane <40072887+AlexanderDCrane@users.noreply.github.com>
Date: Mon, 27 Aug 2018 14:50:31 -0600
Subject: [PATCH] Update click_to_call.php (#3287)

---
 app/click_to_call/click_to_call.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/click_to_call/click_to_call.php b/app/click_to_call/click_to_call.php
index ec2018b501..7b9597b714 100644
--- a/app/click_to_call/click_to_call.php
+++ b/app/click_to_call/click_to_call.php
@@ -255,7 +255,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncellreq' width='40%'>".$text['label-src-caller-id-nam']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"src_cid_name\" value='$src_cid_name' class='formfld'>\n";
+	echo "		<input name=\"src_cid_name\" value='".escape($src_cid_name)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-src-caller-id-nam']."\n";
 	echo "	</td>\n";
@@ -264,7 +264,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncellreq'>".$text['label-src-caller-id-num']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"src_cid_number\" value='$src_cid_number' class='formfld'>\n";
+	echo "		<input name=\"src_cid_number\" value='".escape($src_cid_number)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-src-caller-id-num']."\n";
 	echo "	</td>\n";
@@ -273,7 +273,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncell' width='40%'>".$text['label-dest-caller-id-nam']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"dest_cid_name\" value='$dest_cid_name' class='formfld'>\n";
+	echo "		<input name=\"dest_cid_name\" value='".escape($dest_cid_name)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-dest-caller-id-nam']."\n";
 	echo "	</td>\n";
@@ -282,7 +282,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncell'>".$text['label-dest-caller-id-num']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"dest_cid_number\" value='$dest_cid_number' class='formfld'>\n";
+	echo "		<input name=\"dest_cid_number\" value='".escape($dest_cid_number)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-dest-caller-id-num']."\n";
 	echo "	</td>\n";