Porperly escape HTML special chars in IRC

1 files changed, 2 insertions, 1 deletions

diff --git a/index.php b/index.php
index 80051b9..f6cac6a 100644
--- a/index.php
+++ b/index.php
@@ -223,11 +223,12 @@ if (!isset($date)) {
 			if (!filter_join($line)) {
 				$user = get_user($line);
 				$user_clean = substr($user, 2, -1);
+				$user = htmlentities($user, ENT_QUOTES);
 				$isUser = array_search($user_clean, $users);
 				if ($isUser !== false) {
 					echo '<span style="color: '.$colors[$isUser].'">';
 				}
-				$line = str_replace('&', '&amp;', $line);
+				$line = htmlentities($line, ENT_QUOTES);
 				if ($show_html == 'true') {
 					$line = preg_replace($pattern, "\\1<a href=\"\\2\\3\">\\2\\3</a>\\4", $line);
 				}