Add escape HTML in various area

controller/Account/RegisterController.php

@@ -23,15 +23,15 @@ class RegisterController extends BaseController {
             } else {
                 $biodata = new Entity\GenericEntity(array(
                     "username" => $this->getArg('username'),
-                    "name" => $this->getArg('name'),
-                    "email" => $this->getArg('email'),
-                    "address" => $this->getArg('address'),
-                    "phone" => $this->getArg('phone'),
+                    "name" => escapeHTML($this->getArg('name')),
+                    "email" => escapeHTML($this->getArg('email')),
+                    "address" => escapeHTML($this->getArg('address')),
+                    "phone" => escapeHTML($this->getArg('phone')),
                 ));
                 try {
                     // Create user.
                     $user = new Entity\AccountEntity(array(
-                        "username" => $this->getArg('username'),
+                        "username" => escapeHTML($this->getArg('username')),
                         "password" => $this->getArg('password')
                     ));
                 } catch (Entity\InvalidValueException $e) {

controller/EditController.php

@@ -47,9 +47,9 @@ class EditController extends BaseController {
             //Updating data
             if (isset($this->params["data"]["name"])) {
                 $biodata = $model_biodata->findByID($username);
-                $biodata->name = $this->getArg('name');
-                $biodata->address = $this->getArg('address');
-                $biodata->phone = $this->getArg('phone');
+                $biodata->name = escapeHTML($this->getArg('name'));
+                $biodata->address = escapeHTML($this->getArg('address'));
+                $biodata->phone = escapeHTML($this->getArg('phone'));
                 
                 //Update profile picture
                 if (isset($image_id)) {

framework/lib/util.php

@@ -23,5 +23,8 @@ function alert($message) {
     echo "<script type=\"text/javascript\">alert('$message')</script>";
 }
 
+function escapeHTML($html) {
+    return str_replace(">", "&gt;", str_replace("<", "&lt;", $html));
+}
 
 ?>
\ No newline at end of file

view/biodata.php

@@ -49,7 +49,7 @@
         <td><img class="icon" src="assets/image/address.png" ></td>
         <td class="data_type">Address </td>
         <td><?php
-        $text = str_replace(">", "&gt;", str_replace("<", "&lt;", $data["address"]));
+        $text = escapeHTML($data["address"]);
         echo $text;
         ?></textarea></td>
     </tr>