From a6d864a8902256334b04656dc5b7f347b104d43e Mon Sep 17 00:00:00 2001
From: Eric Espie <eric.espie@combodo.com>
Date: Tue, 19 May 2026 17:34:49 +0200
Subject: [PATCH] =?UTF-8?q?N=C2=B09567=20-=20Extension=20Mgmt=20:=20Run=20?=
 =?UTF-8?q?setup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 setup/wizardsteps/WizStepDataAudit.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/wizardsteps/WizStepDataAudit.php b/setup/wizardsteps/WizStepDataAudit.php
index 97b7ccd8d4..cb4aba4981 100644
--- a/setup/wizardsteps/WizStepDataAudit.php
+++ b/setup/wizardsteps/WizStepDataAudit.php
@@ -110,7 +110,7 @@ JS);
 		];
 		$aHiddenInputs = '';
 		foreach ($aParams as $sParamName) {
-			$sElements = $this->oWizard->GetParameter($sParamName, '[]');
+			$sElements = utils::HtmlEntities($this->oWizard->GetParameter($sParamName, '[]'));
 			$aHiddenInputs .= <<<INPUT
 	<input type="hidden" name="$sParamName" value="$sElements"/>
 INPUT;