From 0b8edb70a34f59e99d00eef6b8fa8dc9f0b40c95 Mon Sep 17 00:00:00 2001
From: Brian Miyaji <brian@themeboy.com>
Date: Mon, 5 Oct 2015 12:26:31 +1100
Subject: [PATCH] Escape input values when importing

---
 includes/admin/importers/class-sp-importer.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/admin/importers/class-sp-importer.php b/includes/admin/importers/class-sp-importer.php
index afe971f2..320dad78 100644
--- a/includes/admin/importers/class-sp-importer.php
+++ b/includes/admin/importers/class-sp-importer.php
@@ -152,7 +152,7 @@ if ( class_exists( 'WP_Importer' ) ) {
 									<tr>
 										<?php $index = 0; foreach ( $this->columns as $key => $label ): $value = sp_array_value( $row, $index ); ?>
 											<td>
-												<input type="text" class="widefat" value="<?php echo $value; ?>" name="sp_import[]">
+												<input type="text" class="widefat" value="<?php echo esc_attr( $value ); ?>" name="sp_import[]">
 											</td>
 										<?php $index ++; endforeach; ?>
 										<td class="sp-actions-column">