From 6342d4513a5791eb1fa392da1ab3d31150c2ebfe Mon Sep 17 00:00:00 2001
From: jekkos <jeroen.peelaerts@gmail.com>
Date: Fri, 19 Jun 2026 22:12:29 +0200
Subject: [PATCH] fix(security): Escape attribute value in register

---
 app/Views/sales/register.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Views/sales/register.php b/app/Views/sales/register.php
index 685b78fe5..e4c04b94d 100644
--- a/app/Views/sales/register.php
+++ b/app/Views/sales/register.php
@@ -179,7 +179,7 @@ helper('url');
                             <?php } else { ?>
                                 <td><?= esc($item['item_number']) ?></td>
                                 <td style="text-align: center;">
-                                    <?= esc($item['name']) . ' ' . implode(' ', [$item['attribute_values'], $item['attribute_dtvalues']]) ?>
+                                    <?= esc($item['name']) . ' ' . esc(implode(' ', [$item['attribute_values'], $item['attribute_dtvalues']])) ?>
                                     <br>
                                     <?php if ($item['stock_type'] == '0'): echo '[' . to_quantity_decimals($item['in_stock']) . ' in ' . esc($item['stock_name']) . ']';
                                     endif; ?>