From b47d631095c02dc2ca6fc56114669e9098c92c5c Mon Sep 17 00:00:00 2001
From: Jocelyn Fiat <git@djoce.net>
Date: Fri, 10 Feb 2017 12:16:09 +0100
Subject: [PATCH] Html escape cms_search_query variable.

---
 examples/demo/site/themes/bootstrap/page.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/demo/site/themes/bootstrap/page.tpl b/examples/demo/site/themes/bootstrap/page.tpl
index 7e1acbc..47c331c 100644
--- a/examples/demo/site/themes/bootstrap/page.tpl
+++ b/examples/demo/site/themes/bootstrap/page.tpl
@@ -42,7 +42,7 @@
 		<div class="col-md-2 col-md-offset-9">
 			<form action="{$site_url/}gcse" class="search-form" id="gcse_search_form">
 				<div class="form-group has-feedback">
-					<input type="search" class="form-control" name="q" id="gcse_search" placeholder="search" value="{$cms_search_query/}" >
+					<input type="search" class="form-control" name="q" id="gcse_search" placeholder="search" value="{htmlentities}{$cms_search_query/}{/htmlentities}" >
 					<span class="glyphicon glyphicon-search form-control-feedback"></span>
 				</div>
 			</form>