From 15d2933a0044dd3e29a59fdc6652b3a4e4e8f0ee Mon Sep 17 00:00:00 2001
From: mark-nielsen <mark-nielsen>
Date: Wed, 6 Dec 2006 02:04:37 +0000
Subject: [PATCH] Merged in changes from MOODLE_17_STABLE for bug MDL-2006

---
 mod/lesson/action/continue.php | 4 ++--
 mod/lesson/report.php          | 6 +++---
 mod/lesson/view.php            | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/mod/lesson/action/continue.php b/mod/lesson/action/continue.php
index a6727b34eff..74899dcdd97 100644
--- a/mod/lesson/action/continue.php
+++ b/mod/lesson/action/continue.php
@@ -88,7 +88,7 @@
                 $noanswer = true;
                 break;
             }            
-            $useranswer = stripslashes(clean_param($useranswer, PARAM_CLEAN));
+            $useranswer = stripslashes(clean_param($useranswer, PARAM_RAW));
             $userresponse = addslashes($useranswer);
             if (!$answers = get_records("lesson_answers", "pageid", $pageid, "id")) {
                 error("Continue: No answers found");
@@ -184,7 +184,7 @@
                     break; // quit answer analysis immediately after a match has been found
                 }
             }
-            $studentanswer = $useranswer;
+            $studentanswer = s($useranswer);
             break;
         
         case LESSON_TRUEFALSE :
diff --git a/mod/lesson/report.php b/mod/lesson/report.php
index 6d4d32a9872..e41b9b7a1c6 100644
--- a/mod/lesson/report.php
+++ b/mod/lesson/report.php
@@ -616,7 +616,7 @@
                                     $total = $stats["total"];
                                     unset($stats["total"]);
                                     foreach ($stats as $valentered => $ntimes) {
-                                        $data = "<input type=\"text\" size=\"50\" disabled=\"disabled\" readonly=\"readonly\" value=\"$valentered\">";
+                                        $data = '<input type="text" size="50" disabled="disabled" readonly="readonly" value="'.s($valentered).'" />';
                                         $percent = $ntimes / $total * 100;
                                         $percent = round($percent, 2);
                                         $percent .= "% ".get_string("enteredthis", "lesson");
@@ -628,7 +628,7 @@
                                 $i++;
                             } else if ($useranswer != NULL and $answer->id == $useranswer->answerid) {
                                 // get in here when a user answer matches one of the answers to the page
-                                $data = "<input type=\"text\" size=\"50\" disabled=\"disabled\" readonly=\"readonly\" value=\"$useranswer->useranswer\">";
+                                $data = '<input type="text" size="50" disabled="disabled" readonly="readonly" value="'.s($useranswer->useranswer).'">';
                                 if (isset($pagestats[$page->id][$useranswer->useranswer])) {
                                     $percent = $pagestats[$page->id][$useranswer->useranswer] / $pagestats[$page->id]["total"] * 100;
                                     $percent = round($percent, 2);
@@ -656,7 +656,7 @@
                                 }
                             } elseif ($answer == end($answers) && empty($answerdata) && $useranswer != NULL) {
                                 // get in here when what the user entered is not one of the answers
-                                $data = "<input type=\"text\" size=\"50\" disabled=\"disabled\" readonly=\"readonly\" value=\"$useranswer->useranswer\">";
+                                $data = '<input type="text" size="50" disabled="disabled" readonly="readonly" value="'.s($useranswer->useranswer).'">';
                                 if (isset($pagestats[$page->id][$useranswer->useranswer])) {
                                     $percent = $pagestats[$page->id][$useranswer->useranswer] / $pagestats[$page->id]["total"] * 100;
                                     $percent = round($percent, 2);
diff --git a/mod/lesson/view.php b/mod/lesson/view.php
index be4a0212b16..8a749470dc1 100644
--- a/mod/lesson/view.php
+++ b/mod/lesson/view.php
@@ -556,7 +556,7 @@
                 case LESSON_SHORTANSWER :
                 case LESSON_NUMERICAL :
                     if (isset($USER->modattempts[$lesson->id])) {     
-                        $value = "value=\"$attempt->useranswer\"";
+                        $value = 'value="'.s($attempt->useranswer).'"';
                     } else {
                         $value = "";
                     }