From b8d79e040dcab1b02b7fde7e85a916fd726a8339 Mon Sep 17 00:00:00 2001
From: Brian Miyaji <brian@themeboy.com>
Date: Sat, 6 Nov 2021 19:08:36 +0900
Subject: [PATCH] Escape output in admin ajax

---
 includes/class-sp-ajax.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/includes/class-sp-ajax.php b/includes/class-sp-ajax.php
index 1abf0592..5edf9f02 100644
--- a/includes/class-sp-ajax.php
+++ b/includes/class-sp-ajax.php
@@ -554,7 +554,7 @@ class SP_AJAX {
 						<option value="default">Default</option>
 						<option value="all">All</option>
 						<?php foreach ( SP()->formats->event as $key => $format ): ?>
-							<option value="<?php echo $key; ?>"><?php echo $format; ?></option>
+							<option value="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $format ); ?></option>
 						<?php endforeach; ?>
 					</select>
 				</label>
@@ -634,7 +634,7 @@ class SP_AJAX {
 				$field_id = 'columns';
 				?>
 				<?php foreach ( $the_columns as $key => $label ): ?>
-					<label class="button"><input name="<?php echo $field_name; ?>" type="checkbox" id="<?php echo $field_id . '-' . $key; ?>" value="<?php echo $key; ?>" checked="checked"><?php echo $label; ?></label>
+					<label class="button"><input name="<?php echo esc_attr( $field_name ); ?>" type="checkbox" id="<?php echo esc_attr( $field_id ) . '-' . esc_attr( $key ); ?>" value="<?php echo esc_attr( $key ); ?>" checked="checked"><?php echo esc_html( $label ); ?></label>
 				<?php endforeach; ?>
 			</p>
 			<p>
@@ -761,7 +761,7 @@ class SP_AJAX {
 					<option value="default">Default</option>
 					<option value="all">All</option>
 					<?php foreach ( SP()->formats->event as $key => $format ): ?>
-					<option value="<?php echo $key; ?>"><?php echo $format; ?></option>
+					<option value="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $format ); ?></option>
 					<?php endforeach; ?>
 					</select>
 				</label>
@@ -898,7 +898,7 @@ class SP_AJAX {
 				$field_id = 'columns';
 				?>
 				<?php foreach ( $the_columns as $column ): ?>
-					<label class="button"><input name="<?php echo $field_name; ?>" type="checkbox" id="<?php echo $field_id . '-' . $column->post_name; ?>" value="<?php echo $column->post_name; ?>" checked="checked"><?php echo $column->post_title; ?></label>
+					<label class="button"><input name="<?php echo esc_attr) $field_name ); ?>" type="checkbox" id="<?php echo esc_attr( $field_id ) . '-' . esc_attr( $column->post_name ); ?>" value="<?php echo esc_attr( $column->post_name ); ?>" checked="checked"><?php echo esc_html( $column->post_title ); ?></label>
 				<?php endforeach; ?>
 			</p>
 			<p>
@@ -1152,7 +1152,7 @@ class SP_AJAX {
 				<label class="button"><input name="columns[]" type="checkbox" id="columns-team" value="team" checked="checked"><?php _e( 'Team', 'sportspress' ); ?></label>
 				<label class="button"><input name="columns[]" type="checkbox" id="columns-position" value="position" checked="checked"><?php _e( 'Position', 'sportspress' ); ?></label>
 				<?php foreach ( $the_columns as $column ): ?>
-					<label class="button"><input name="<?php echo $field_name; ?>" type="checkbox" id="<?php echo $field_id . '-' . $column->post_name; ?>" value="<?php echo $column->post_name; ?>" checked="checked"><?php echo $column->post_title; ?></label>
+					<label class="button"><input name="<?php echo esc_attr( $field_name ); ?>" type="checkbox" id="<?php echo esc_attr( $field_id ) . '-' . esc_attr( $column->post_name ); ?>" value="<?php echo esc_attr( $column->post_name ); ?>" checked="checked"><?php echo esc_html( $column->post_title ); ?></label>
 				<?php endforeach; ?>
 			</p>
 			<p>