From 693662b4641c7b175d4f9d1c88f96a0f603848c6 Mon Sep 17 00:00:00 2001
From: Arun Philip <dacodedbeat@gmail.com>
Date: Fri, 20 Sep 2024 23:36:55 -0400
Subject: [PATCH] initialize $sRowClass so AlternateRowStyle works

---
 src/QuerySQL.php  | 6 +++---
 src/QueryView.php | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/QuerySQL.php b/src/QuerySQL.php
index f29de9d51d..4ac9353d97 100644
--- a/src/QuerySQL.php
+++ b/src/QuerySQL.php
@@ -74,7 +74,7 @@ function ExportQueryResults(string $sSQL, &$rsQueryResults)
 
         $sCSVstring .= "\n";
 
-        //Loop through the recordsert
+        //Loop through the recordset
         while ($aRow = mysqli_fetch_array($rsQueryResults)) {
             //Loop through the fields and write each one
             for ($iCount = 0; $iCount < mysqli_num_fields($rsQueryResults); $iCount++) {
@@ -132,7 +132,7 @@ function RunFreeQuery(string $sSQL, &$rsQueryResults)
 
         echo '</tr>';
 
-        //Loop through the recordsert
+        //Loop through the recordset
         while ($aRow = mysqli_fetch_array($rsQueryResults)) {
             $sRowClass = AlternateRowStyle($sRowClass);
 
@@ -146,7 +146,7 @@ function RunFreeQuery(string $sSQL, &$rsQueryResults)
                     $aHiddenFormField[] = $aRow[$iCount];
                 } else {  //...otherwise just render the field
                     //Write the actual value of this row
-                    echo '<td align="center">' . $aRow[$iCount] . '</td>';
+                    echo '<td align="center">' . htmlspecialchars($aRow[$iCount]) . '</td>';
                 }
             }
             echo '</tr>';
diff --git a/src/QueryView.php b/src/QueryView.php
index 62cd34938f..6224985c4a 100644
--- a/src/QueryView.php
+++ b/src/QueryView.php
@@ -203,6 +203,7 @@ function DoQuery()
     <?php
     $aAddToCartIDs = [];
 
+    $sRowClass = 'RowColorA';
     while ($aRow = mysqli_fetch_array($rsQueryResults)) {
         // Alternate the background color of the row
         $sRowClass = AlternateRowStyle($sRowClass);
@@ -229,7 +230,7 @@ function DoQuery()
             } else {
                 // ...otherwise just render the field
                 // Write the actual value of this row
-                echo '<td>' . $aRow[$iCount] . '</td>';
+                echo '<td>' . htmlspecialchars($aRow[$iCount]) . '</td>';
             }
         }