X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=fs_selfservice%2FFS-SelfService%2Fcgi%2Fchange_pkg.html;h=2d7b488abce05c7fdb65353c99b9968399d80199;hb=e513d7cb331d7c7d99d1ea7b5f0a5f8e08e0d725;hp=a841308a548f8a18638debb123e2027dcf7cff1a;hpb=5e05724a635a22776f1b973f5d7e77989da4e048;p=freeside.git

diff --git a/fs_selfservice/FS-SelfService/cgi/change_pkg.html b/fs_selfservice/FS-SelfService/cgi/change_pkg.html
index a841308a5..2d7b488ab 100644
--- a/fs_selfservice/FS-SelfService/cgi/change_pkg.html
+++ b/fs_selfservice/FS-SelfService/cgi/change_pkg.html
@@ -14,8 +14,8 @@ function enable_change_pkg () {
 <FORM NAME="ChangePkgForm" ACTION="<%= $selfurl %>" METHOD=POST>
 <INPUT TYPE="hidden" NAME="session" VALUE="<%= $session_id %>">
 <INPUT TYPE="hidden" NAME="action" VALUE="process_change_pkg">
-<INPUT TYPE="hidden" NAME="pkgnum" VALUE="<%= $pkgnum %>">
-<INPUT TYPE="hidden" NAME="pkg" VALUE="<%= $pkg %>">
+<INPUT TYPE="hidden" NAME="pkgnum" VALUE="<%= encode_entities($pkgnum) %>">
+<INPUT TYPE="hidden" NAME="pkg" VALUE="<%= encode_entities($pkg) %>">
 <TABLE BGCOLOR="#cccccc" BORDER=0 CELLSPACING=0>
 <TR>
   <TD COLSPAN=2><SELECT NAME="pkgpart" onChange="enable_change_pkg()">