Skill: filter HTML when saving profiles

main/inc/lib/skill.lib.php

@@ -63,11 +63,14 @@ class SkillProfile extends Model
         $name = Database::escape_string($name);
         $description = Database::escape_string($description);
 
-        $sql = "UPDATE $this->table SET
+        Database::update(
-                    name = '$name',
+            $this->table,
-                    description = '$description'
+            [
-                WHERE id = $profileId ";
+                'name' => html_filter($name),
-        Database::query($sql);
+                'description' => html_filter($description),
+            ],
+            ['id = ?' => $profileId]
+        );
 
         return true;
     }
@@ -83,6 +86,9 @@ class SkillProfile extends Model
     public function save($params, $show_query = false)
     {
         if (!empty($params)) {
+            $params['name'] = html_filter($params['name']);
+            $params['description'] = html_filter($params['description']);
+
             $profile_id = parent::save($params, $show_query);
             if ($profile_id) {
                 $skill_rel_profile = new SkillRelProfile();