From 56e18c151d8c01f72b626540da99205becaa8da4 Mon Sep 17 00:00:00 2001
From: Pavel Dohnal <pavel.dohnal@automattic.com>
Date: Mon, 19 Jul 2021 11:06:21 +0200
Subject: [PATCH] Encode value before printing it

[MAILPOET-3698]
---
 lib/Subscription/CaptchaRenderer.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Subscription/CaptchaRenderer.php b/lib/Subscription/CaptchaRenderer.php
index 9103701a1f..2324afd2dd 100644
--- a/lib/Subscription/CaptchaRenderer.php
+++ b/lib/Subscription/CaptchaRenderer.php
@@ -98,7 +98,7 @@ class CaptchaRenderer {
       'class="mailpoet_form mailpoet_captcha_form" ' .
       'novalidate>';
     $formHtml .= '<input type="hidden" name="data[form_id]" value="' . $formId . '" />';
-    $formHtml .= '<input type="hidden" name="data[captcha_session_id]" value="' . $this->captchaSession->getId() . '" />';
+    $formHtml .= '<input type="hidden" name="data[captcha_session_id]" value="' . htmlspecialchars($this->captchaSession->getId()) . '" />';
     $formHtml .= '<input type="hidden" name="api_version" value="v1" />';
     $formHtml .= '<input type="hidden" name="endpoint" value="subscribers" />';
     $formHtml .= '<input type="hidden" name="mailpoet_method" value="subscribe" />';