http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13127 Bug ID: 13127 Summary: SQL report creation mangles HTML if using non-existent auth value Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: gmcharlt@gmail.com Reporter: pasi.kallinen@pttk.fi QA Contact: testopia@bugs.koha-community.org Create a new report from SQL, enter the following as the SQL: select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>' Save the report, and Koha complains "whatever: The authorized value category (NON_EXISTENT_AUTHVAL) you selected does not exist.", with some random garbage characters on the screen. The garbage happens because part of the page HTML looks like this: <input type='hidden' name='sql' value='select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>' ' /> This is obviously wrong, the sql in there should be html encoded. -- You are receiving this mail because: You are watching all bug changes.