From 630e913fa7f1d6c132c97d821e82ac36f831b846 Mon Sep 17 00:00:00 2001
From: Savvas Hadjigeorgiou <savvasha@hotmail.com>
Date: Fri, 5 Nov 2021 13:50:50 +0200
Subject: [PATCH] Escape vars on Event Performance Importer

---
 .../admin/importers/class-sp-event-performance-importer.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/admin/importers/class-sp-event-performance-importer.php b/includes/admin/importers/class-sp-event-performance-importer.php
index 8968e257..d0d59e13 100644
--- a/includes/admin/importers/class-sp-event-performance-importer.php
+++ b/includes/admin/importers/class-sp-event-performance-importer.php
@@ -181,9 +181,9 @@ if ( class_exists( 'WP_Importer' ) ) {
 							<a href="<?php echo get_post_permalink( $event ); ?>" target="_blank">
 								<?php echo get_the_title( $event ); ?>
 							</a>
-							<input type="hidden" name="sp_event" value="<?php echo $event; ?>">
-							<input type="hidden" name="sp_teams" value="<?php echo $teams; ?>">
-							<input type="hidden" name="sp_index" value="<?php echo $index; ?>">
+							<input type="hidden" name="sp_event" value="<?php echo esc_attr( $event ); ?>">
+							<input type="hidden" name="sp_teams" value="<?php echo esc_attr( $teams ); ?>">
+							<input type="hidden" name="sp_index" value="<?php echo esc_attr( $index ); ?>">
 						</td>
 					</tr>
 					<tr>