form text fields now make htmlspecialchars

includes/pages/guest_login.php

@@ -48,7 +48,7 @@ function guest_register() {
       }
     } else {
       $ok = false;
-      $msg .= error(sprintf(_("Your nick "%s" is too short (min. 2 characters)."), strip_request_item('nick')), true);
+      $msg .= error(sprintf(_("Your nick "%s" is too short (min. 2 characters)."), User_validate_Nick($_REQUEST['nick'])), true);
     }
     
     if (isset($_REQUEST['mail']) && strlen(strip_request_item('mail')) > 0) {

includes/sys_template.php

@@ -113,7 +113,7 @@ function form_submit($name, $label) {
  */
 function form_text($name, $label, $value, $disabled = false) {
   $disabled = $disabled ? ' disabled="disabled"' : '';
-  return form_element($label, '<input id="form_' . $name . '" type="text" name="' . $name . '" value="' . $value . '" ' . $disabled . '/>', 'form_' . $name);
+  return form_element($label, '<input id="form_' . $name . '" type="text" name="' . $name . '" value="' . htmlspecialchars($value) . '" ' . $disabled . '/>', 'form_' . $name);
 }
 
 /**