Ldap.php: All values from LDAP will be HTML entity encoded.

extension/qfq/qfq/helper/Ldap.php

@@ -135,7 +135,7 @@ class Ldap {
             // Collect all attributes
             foreach ($attr as $key) {
                 $value = isset($info[0][$key][0]) ? $info[0][$key][0] : '';
-                $arr[$key] = $value;
+                $arr[$key] = htmlentities($value);
             }
         }
         ldap_close($ds);
@@ -193,7 +193,7 @@ class Ldap {
         $args = array($format);
 
         foreach ($keyArr as $key) {
-            $args[] = (isset($infoElement[$key][0])) ? $infoElement[$key][0] : '';
+            $args[] = (isset($infoElement[$key][0])) ? htmlentities($infoElement[$key][0]) : '';
         }
 
         return call_user_func_array('sprintf', $args);