[svn r21173] change code, title survey character special- fixed FS#4269

main/survey/survey.lib.php

@@ -24,7 +24,7 @@
 *	@package dokeos.survey
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University: cleanup, refactoring and rewriting large parts (if not all) of the code
 	@author Julio Montoya Armas <gugli100@gmail.com>, Dokeos: Personality Test modification and rewriting large parts of the code
-* 	@version $Id: survey.lib.php 21170 2009-06-01 20:53:44Z cfasanando $
+* 	@version $Id: survey.lib.php 21173 2009-06-01 20:58:59Z jhp1411 $
 *
 * 	@todo move this file to inc/lib
 * 	@todo use consistent naming for the functions (save vs store for instance)
@@ -240,7 +240,7 @@ class survey_manager
 				}
 			}
 			$sql = "INSERT INTO $table_survey (code, title, subtitle, author, lang, avail_from, avail_till, is_shared, template, intro, surveythanks, creation_date, anonymous".$additional['columns'].", session_id) VALUES (
-							'".Database::escape_string(Security::remove_XSS($values['survey_code']))."',
+						'".Database::escape_string(strtolower(generate_course_code(api_substr($values['survey_code']))))."',
 						'".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['survey_title'])),COURSEMANAGERLOWSECURITY))."',
 						'".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['survey_subtitle'])),COURSEMANAGERLOWSECURITY))."',
 						'".Database::escape_string($_user['user_id'])."',
@@ -1368,7 +1368,7 @@ class question
 		$this->html .= '			<span class="form_required">*</span> '.get_lang('Question');
 		$this->html .= '		</div>';
 		$this->html .= '		<div class="formw">';
-		$this->html .= api_return_html_area('question', api_html_entity_decode(stripslashes($form_content['question']), ENT_QUOTES, $charset));
+		$this->html .= api_return_html_area('question', Security::remove_XSS(stripslashes($form_content['question'])));
 		$this->html .= '		</div>';
 		$this->html .= '	</div>';