- Adds data sanitization on the client and server side

- Closes #641

assets/js/src/subscribers/importExport/import.js

@@ -337,9 +337,19 @@ define(
               complete: function (CSV) {
                 for (var rowCount in CSV.data) {
                   var rowData = CSV.data[rowCount].map(function (el) {
-                        return filterXSS(el.trim());
-                      }),
-                      rowColumnCount = rowData.length;
+                    // sanitize data
+                    el = filterXSS(el.trim());
+                    var entityMap = {
+                      "<": "&lt;",
+                      ">": "&gt;",
+                      "/": '&#x2F;'
+                    };
+                    el = String(el).replace(/[&<>"'\/]/g, function (s) {
+                      return entityMap[s];
+                    });
+                    return el;
+                  });
+                  var rowColumnCount = rowData.length;
                   // set the number of row elements based on the first non-empty row
                   if (columnCount === null) {
                     columnCount = rowColumnCount;

lib/Subscribers/ImportExport/Import/Import.php

@@ -110,6 +110,8 @@ class Import {
   function validateSubscribersFields($subscribers_data, $validation_rules) {
     $invalid_records = array();
     foreach($subscribers_data as $column => &$data) {
+      // sanitize each data field
+      $data = array_map('sanitize_text_field', $data);
       $validation_rule = $validation_rules[$column];
       // if this is a custom column
       if(in_array($column, $this->subscriber_custom_fields)) {