From 9899fd6a1efc240196b61977b0582529ef6dc5ba Mon Sep 17 00:00:00 2001
From: Kariamos <minucci9292@gmail.com>
Date: Tue, 6 May 2025 13:09:35 +0200
Subject: [PATCH 1/2] fix(mvc_form_helper): correct HTML escaping in select
 options

---
 core/helpers/mvc_form_helper.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/helpers/mvc_form_helper.php b/core/helpers/mvc_form_helper.php
index 2b56424..2e10cc8 100644
--- a/core/helpers/mvc_form_helper.php
+++ b/core/helpers/mvc_form_helper.php
@@ -331,7 +331,7 @@ public function select_tag($field_name, $options=array()) {
                 $selected_attribute = $options['value'] == $key ? ' selected="selected"' : '';
             }
 
-            $html .= '<option value="'.$this->esc_attr($key).'"'.$selected_attribute.'>'.$value.'</option>';
+            $html .= '<option value="'.$this->esc_attr($key).'"'.$selected_attribute.'>'.esc_html($value.'</option>');
         }
         $html .= '</select>';
         return $html;

From 8f4819f2bb0bca8ddbaec1ee82b21f79382c3e09 Mon Sep 17 00:00:00 2001
From: Kariamos <minucci9292@gmail.com>
Date: Tue, 6 May 2025 13:11:31 +0200
Subject: [PATCH 2/2] fix(mvc_form_helper): correct HTML closing tag in select
 options

---
 core/helpers/mvc_form_helper.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/helpers/mvc_form_helper.php b/core/helpers/mvc_form_helper.php
index 2e10cc8..3c0f8bb 100644
--- a/core/helpers/mvc_form_helper.php
+++ b/core/helpers/mvc_form_helper.php
@@ -331,7 +331,7 @@ public function select_tag($field_name, $options=array()) {
                 $selected_attribute = $options['value'] == $key ? ' selected="selected"' : '';
             }
 
-            $html .= '<option value="'.$this->esc_attr($key).'"'.$selected_attribute.'>'.esc_html($value.'</option>');
+            $html .= '<option value="'.$this->esc_attr($key).'"'.$selected_attribute.'>'.esc_html($value).'</option>';
         }
         $html .= '</select>';
         return $html;