From 2bd2cb90d0845c773653e27c60d359b3264db8dd Mon Sep 17 00:00:00 2001
From: Bowo <wibowosulistio@gmail.com>
Date: Mon, 17 Apr 2023 04:45:18 +0700
Subject: [PATCH] Improve escaping of variable content

Useful for scenarios when string type variables have HTML tags in them. Prevents inspector layout / HTML output from being affected by such variable content.
---
 .gitignore                               | 5 ++++-
 admin/class-variable-inspector-admin.php | 6 +++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index ca8a2b7..3fb7e30 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
 sftp-config.json
 notes.txt
 .gitignore
-.DS_Store
\ No newline at end of file
+.DS_Store
+admin/css/dump-print-r/dump-print-r.css
+
+admin/css/dump-print-tree/dump-print-tree.css
diff --git a/admin/class-variable-inspector-admin.php b/admin/class-variable-inspector-admin.php
index 3b9121e..86fbecd 100644
--- a/admin/class-variable-inspector-admin.php
+++ b/admin/class-variable-inspector-admin.php
@@ -393,13 +393,13 @@ public function vi_inspection_results()
                                 <a class="item" data-tab="print_r">print_r</a>';
             $output .= '</div>
                             <div class="ui tab varexport" data-tab="var_export">
-                                <pre>' . $variable_content_varexport . '</pre>
+                                <pre>' . esc_html( $variable_content_varexport ) . '</pre>
                             </div>
                             <div class="ui tab vardump" data-tab="var_dump">
-                                <pre>' . $variable_content_vardump . '</pre>
+                                <pre>' . esc_html( $variable_content_vardump ) . '</pre>
                             </div>
                             <div class="ui tab printr" data-tab="print_r">
-                                <pre>' . print_r( $variable_content, true ) . '</pre>
+                                <pre>' . esc_html( print_r( $variable_content, true ) ) . '</pre>
                             </div>';
             $output .= '<script>
                                 jQuery("#' . esc_html( $identifier ) . ' .functions .item")