Elgg / Elgg

views/default/input/userpicker/item.php

<?php
/**
 * User view in User Picker
 *
 * @package Elgg
 * @subpackage Core
 *
 * @uses $vars['entity'] User entity
 * @uses $vars['input_name'] Name of the returned data array
 */

/* @var ElggEntity $entity */
$entity = $vars['entity'];
$input_name = $vars['input_name'];


$icon = elgg_view_entity_icon($entity, 'tiny', ['use_hover' => false]);

$name = $entity->name;
if ($name == '') {
	$name = $entity->title;
}

?>
<li class="elgg-item" data-guid='<?php echo $entity->guid ?>'>
	<div class='elgg-image-block'>
		<div class='elgg-image'><?php echo $icon ?></div>
		<div class='elgg-image-alt'><?php echo elgg_view_icon('delete', 'elgg-user-picker-remove'); ?></div>
		<div class='elgg-body'><?php echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8'); ?></div>

It seems like $name can also be of type array; however, parameter $string of htmlspecialchars() does only seem to accept string, maybe add an additional type check?

	</div>
	<input type="hidden"
		   name="<?php echo htmlspecialchars($input_name, ENT_QUOTES, 'UTF-8'); ?>[]"
		   value="<?php echo $entity->guid ?>">
</li>