Merge pull request #10 from travisulrich/patch-3

Escape HTML output before adding <br> tags
adamlc · Mar 7, 2015 · 130d827 · 130d827
2 parents 143d218 + 4cda187
commit 130d827
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/Adamlc/AddressFormat/Format.php b/src/Adamlc/AddressFormat/Format.php
@@ -109,6 +109,7 @@ public function formatAddress($html = false)
 
             //Replace new lines!
             if ($html) {
+                $formatted_address = htmlentities($formatted_address, ENT_QUOTES, 'UTF-8', false);
                 $formatted_address = str_replace('%n', "\n" . '<br>', $formatted_address);
             } else {
                 $formatted_address = trim(str_replace('%n', "\n", $formatted_address));