Escape request and database values in forms and links.

Add form_value() in html.lib.php.

publish/addeditor.php

@@ -46,10 +46,10 @@ if (!isset($_SESSION['editor'])) {
 <H1>add editor</H1>
 
 <?php if ($added) { ?>
-  <p>Added editor <?= $username ?></p>
+  <p>Added editor <?= form_value($username) ?></p>
 <?php } else { ?>
 
-<form action="https://xxx.org.za<?= $_SERVER['REQUEST_URI'] ?>" method="post">
+<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
   <div class="grid">
 
     <label for="username">Username: </label>